PHP Academy · Lesson

GET vs POST: When to Use Each

Understand the difference between HTTP GET and POST in PHP.

GET vs POST: When to Use Each is a free PHP Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the PHP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

HTTP Methods in Web PHP

When a browser submits an HTML form, it uses either the GET or POST HTTP method. PHP captures the submitted data via superglobals:

$_GET — data appended to the URL
$_POST — data in the request body

GET Method

GET appends form data as query string parameters to the URL:

<!-- HTML form -->
<form method="GET" action="search.php">
    <input name="query" type="text">
    <button type="submit">Search</button>
</form>

<!-- URL becomes: search.php?query=php+tutorial -->

<?php
$q = $_GET['query'] ?? '';
echo 'You searched for: ' . htmlspecialchars($q);

POST Method

POST sends data in the HTTP request body — not visible in the URL:

<!-- HTML form -->
<form method="POST" action="login.php">
    <input name="email" type="email">
    <input name="password" type="password">
    <button type="submit">Log In</button>
</form>

<?php
$email    = $_POST['email']    ?? '';
$password = $_POST['password'] ?? '';

When to Use GET

Use GET when:

The request is idempotent (no side effects)
Data can appear in the URL — search queries, filters, pagination
You want bookmarkable or shareable URLs
Data is not sensitive

When to Use POST

Use POST when:

The request changes server state (create, update, delete)
Data is sensitive (passwords, personal info)
Sending large amounts of data (files, long text)
You don't want data cached by browsers or proxies

GET Length Limits

GET requests have URL length limits (typically ~2000 chars in practice). POST has no practical limit except server configuration:

<?php
// php.ini settings for POST limits:
// post_max_size = 8M   (total POST body size)
// upload_max_filesize = 2M

// Check current limits at runtime:
echo ini_get('post_max_size');        // 8M
echo ini_get('upload_max_filesize');  // 2M

$_REQUEST Superglobal

$_REQUEST merges $_GET, $_POST, and $_COOKIE. Convenient but less clear about data source:

<?php
// Works for both GET and POST but is ambiguous
$name = $_REQUEST['name'] ?? '';

// Better: be explicit about the expected method
$name = match($_SERVER['REQUEST_METHOD']) {
    'GET'  => $_GET['name']  ?? '',
    'POST' => $_POST['name'] ?? '',
    default => '',
};

Checking Request Method

Always check the request method before processing form data:

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name = trim($_POST['name'] ?? '');
    if (!empty($name)) {
        echo 'Hello, ' . htmlspecialchars($name);
    }
} else {
    // Show empty form
}

HTTPS and Data Security

Even with POST, data is visible in plain text unless you use HTTPS. Key security rules:

Always use HTTPS in production
Never send passwords via GET
POST over HTTP is still insecure — HTTPS encrypts the body too

Redirecting After POST (PRG Pattern)

After a successful POST, redirect to a GET request to prevent duplicate submissions on refresh:

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Process the form...
    $id = saveToDatabase($_POST);
    
    // Post-Redirect-Get (PRG) pattern
    header('Location: /success.php?id=' . $id);
    exit;
}

Multipart Forms for File Uploads

To upload files, the form must use enctype="multipart/form-data" with POST:

<!-- Required for file uploads -->
<form method="POST" action="upload.php"
      enctype="multipart/form-data">
    <input type="file" name="avatar">
    <button type="submit">Upload</button>
</form>

<?php
$file = $_FILES['avatar'];
echo $file['name'];  // original filename

Quick Check

Which HTTP method should you use when submitting a login form with username and password?

Recap: GET vs POST

Key differences:

GET — in URL, bookmarkable, no side effects, limited size
POST — in body, sensitive data, no URL limit
Always use HTTPS to protect both GET and POST data
Check $_SERVER['REQUEST_METHOD'] before processing
Apply PRG pattern to prevent duplicate POST submissions

Frequently asked questions

Is the “GET vs POST: When to Use Each” lesson free?

Yes — the full text of “GET vs POST: When to Use Each” is free to read here on the web, and the PHP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the PHP Academy course, upgrade to CoddyKit PRO.

What will I learn in “GET vs POST: When to Use Each”?

Understand the difference between HTTP GET and POST in PHP. You practise PHP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start PHP Academy?

No prior experience is required. PHP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “GET vs POST: When to Use Each” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this PHP Academy lesson?

Yes. Every PHP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to PHP Academy