[php] Among $_REQUEST, $_GET and $_POST which one is the fastest?

Which of these code will be faster?

$temp = $_REQUEST['s'];

or

if (isset($_GET['s'])) {
  $temp = $_GET['s'];
}
else {
  $temp = $_POST['s'];
}

You are prematurely optimizing. Also, you should really put some thought into whether GET should be used for stuff you're POST-ing, for security reasons.

I would use $_POST, and $_GET because differently from $_REQUEST their content is not influenced by variables_order.
When to use $_POST and $_GET depends on what kind of operation is being executed. An operation that changes the data handled from the server should be done through a POST request, while the other operations should be done through a GET request. To make an example, an operation that deletes a user account should not be directly executed after the user click on a link, while viewing an image can be done through a link.

I would use the second method as it is more explicit. Otherwise you don't know where the variables are coming from.

Why do you need to check both GET and POST anyway? Surely using one or the other only makes more sense.

It's ugly and I wouldn't recommended it as a final solution when pushing code live, but while building rest functions, it's sometimes handy to have a 'catch-all' parameter grabber:

public static function parseParams() {
    $params = array();
    switch($_SERVER['REQUEST_METHOD']) {
        case "PUT":
        case "DELETE":
            parse_str(file_get_contents('php://input'), $params);
            $GLOBALS["_{$_SERVER['REQUEST_METHOD']}"] = $params;
            break;
        case "GET":
            $params = $_GET;
            break;
        case "POST":
            $params = $_POST;
            break;
        default:
            $params = $_REQUEST;
            break;
    }
    return $params;
}

Someone creative could probably even add to it to handle command line parameters or whatever comes from your IDE. Once you decide what a given rest-function is doing, you can pick one appropriate for that given call to make sure you get what you need for the deploy version. This assumes 'REQUEST_METHOD' is set.

There are certain security concerns involved as a hacker can set a cookie that will override a $_POST or $_GET value. If you handle sensitive data, I would not recommend using $_REQUEST. – Xandor

you can't be used $_GET alternative of $_POST on some case.

When ??

• when you want to upload a file.
• when you don't won't to show a data in url.

GET also has limits on the amount of information to send. The limitation is about 2000 characters.

Other thing's there are few case when you can't retrieve a data using $_POST

When ?

• when data is passed in URL.

For Rest Service

`GET` - Provides a read only access to a resource.

`PUT` - Used to create a new resource.

there is nothing be wrong to use $_REQUEST.

But the way to do that is to check $_SERVER['REQUEST_METHOD'] explicitly, not rely on $_POST being empty for a GET.

$_GET retrieves variables from the querystring, or your URL.>

$_POST retrieves variables from a POST method, such as (generally) forms.

$_REQUEST is a merging of $_GET and $_POST where $_POST overrides $_GET. Good to use $_REQUEST on self refrential forms for validations.

I use this,

$request = (count($_REQUEST) > 1)?$_REQUEST:$_GET;

the statement validates if $_REQUEST has more than one parameter (the first parameter in $_REQUEST will be the request uri which can be used when needed, some PHP packages wont return $_GET so check if its more than 1 go for $_GET, By default, it will be $_POST.

$_GET retrieves variables from the querystring, or your URL.>

$_POST retrieves variables from a POST method, such as (generally) forms.

$_REQUEST is a merging of $_GET and $_POST where $_POST overrides $_GET. Good to use $_REQUEST on self refrential forms for validations.

GET vs. POST

1) Both GET and POST create an array (e.g. array( key => value, key2 => value2, key3 => value3, ...)). This array holds key/value pairs, where keys are the names of the form controls and values are the input data from the user.

2) Both GET and POST are treated as $_GET and $_POST. These are superglobals, which means that they are always accessible, regardless of scope - and you can access them from any function, class or file without having to do anything special.

3) $_GET is an array of variables passed to the current script via the URL parameters.

4) $_POST is an array of variables passed to the current script via the HTTP POST method.

When to use GET?

Information sent from a form with the GET method is visible to everyone (all variable names and values are displayed in the URL). GET also has limits on the amount of information to send. The limitation is about 2000 characters. However, because the variables are displayed in the URL, it is possible to bookmark the page. This can be useful in some cases.

GET may be used for sending non-sensitive data.

Note: GET should NEVER be used for sending passwords or other sensitive information!

When to use POST?

Information sent from a form with the POST method is invisible to others (all names/values are embedded within the body of the HTTP request) and has no limits on the amount of information to send.

Moreover POST supports advanced functionality such as support for multi-part binary input while uploading files to server.

However, because the variables are not displayed in the URL, it is not possible to bookmark the page.

I only ever use _GET or _POST. I prefer to have control.

What I don't like about either code fragment in the OP is that they discard the information on which HTTP method was used. And that information is important for input sanitization.

For example, if a script accepts data from a form that's going to be entered into the DB then the form had better use POST (use GET only for idempotent actions). But if the script receives the input data via the GET method then it should (normally) be rejected. For me, such a situation might warrant writing a security violation to the error log since it's a sign somebody is trying something on.

With either code fragment in the OP, this sanitization wouldn't be possible.

if (isset($_GET['s'])) {
  $temp = $_GET['s'];
}
else {
  $temp = $_POST['s'];
}

Use that because it is safer and it won't make noticeable speed difference

I'd suggest using $_POST and $_GET explicitly.

Using $_REQUEST should be unnecessary with proper site design anyway, and it comes with some downsides like leaving you open to easier CSRF/XSS attacks and other silliness that comes from storing data in the URL.

The speed difference should be minimal either way.

Don't worry. But you should still use the second solution (plus an extra check for none of those variables existing), because there are security issues with $_REQUEST (since $_GET and $_POST aren't the only sources for that array).

There was a post about the problems with $_REQUEST yesterday, I believe. Let me go find it.

EDIT: Oh well, not directly a post, but here it is anyway: http://kuza55.blogspot.com/2006/03/request-variable-fixation.html

Use REQUEST. Nobody cares about the speed of such a simple operation, and it's much cleaner code.