Superglobals are predefined PHP variables available in any scope of the script.
In PHP, the term Superglobal refers to predefined variables (arrays) that are available in any part of your code (functions, classes, included files) without the need to declare them with global $variable.
They are PHP’s “eyes and ears”: they contain all the information about who visits the page, what data they send, and in what environment the server is running.
$_SERVER: environment and request information
It is, by far, the most used for routing logic and detection. It is a giant array generated by the web server (Apache, Nginx) that passes data to PHP.
It contains technical information about the visit.
Most important indices:
| Index | Description | Usage Example |
|---|---|---|
$_SERVER['REQUEST_METHOD'] | Method used (GET, POST, PUT…). | Knowing whether a form was submitted or the page was just visited. |
$_SERVER['REQUEST_URI'] | The requested URL address. | Essential for creating “Routers”. |
$_SERVER['REMOTE_ADDR'] | The visitor’s IP address. | Blocking IPs or saving security logs. |
$_SERVER['HTTP_USER_AGENT'] | User’s browser and OS. | Detecting if it’s mobile (though using CSS is better). |
$_SERVER['DOCUMENT_ROOT'] | The server’s root folder. | For including files in an absolute and safe way. |
Practical Example: Imagine you want to execute code only if the user submitted data (POST), not if they just entered to look (GET).
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
echo "You have submitted the form!";
// Here we would process the data
} else {
echo "You are viewing the page (GET Method)";
}Some data in $_SERVER (like HTTP_USER_AGENT or HTTP_REFERER) are sent by the user’s browser and can be spoofed. Never blindly trust them for critical security.
$_ENV: environment variables and secrets
Environment variables allow separating configuration from code. In professional development, we do not write passwords directly into the repository ($password = '1234').
$_ENV can expose the variables that the operating system or server passes to PHP. Its availability depends on the variables_order configuration; getenv() is another way to query them.
Why use $_ENV?
- Security: If you upload your code to GitHub, you don’t upload your real passwords.
- Flexibility: On your local machine the database is
localhost, but in production it’s an Amazon AWS IP. The code doesn’t change, only the environment changes.
// Correct way to connect to a modern DB
$host = $_ENV['DB_HOST']; // Comes from the server config
$user = $_ENV['DB_USER'];
$pass = $_ENV['DB_PASS'];In modern projects, libraries like phpdotenv are often used to load these variables from a .env file.
The rest of the family (summary)
The rest of the superglobals are so important that they have their own sections in this module, but it’s good to know that they all work the same way: they are arrays accessible from anywhere.
$_GET: Data sent via the URL (?id=5).$_POST: Data sent via an invisible form.$_FILES: Uploaded files.$_COOKIE: Data stored in the user’s browser.$_SESSION: Data stored on the server associated with the user.
