2nd/10_Wiki/Dev/Topic_PHP/PHP_Superglobals_Request.md

id, title, category, status, verification_status, canonical_id, aliases, duplicate_of, source_trust_level, confidence_score, created_at, updated_at, review_reason, merge_history, tags, raw_sources, applied_in, github_commit

id	title	category	status	verification_status	canonical_id	aliases	duplicate_of	source_trust_level	confidence_score	created_at	updated_at	review_reason	merge_history	tags	raw_sources	applied_in	github_commit
php-superglobals-request	PHP Superglobals Request	Programming_Language	draft	conceptual		$_REQUEST PHP 요청 슈퍼글로벌		B	0.88	2026-07-04	2026-07-04			php programming w3schools superglobals request security	https://www.w3schools.com/php/php_superglobals_request.asp

PHP Superglobals Request

🎯 한 줄 통찰 (One-line insight)

$_REQUEST's convenience is explicitly flagged as a security liability — because it silently merges GET, POST, and COOKIE data into one array, the source recommends using the more specific $_GET/$_POST/$_COOKIE superglobals whenever possible, since $_REQUEST can't distinguish where a value actually came from. [S1]

🧠 핵심 개념 (Core concepts)

• $_REQUEST — combines data from $_GET, $_POST, and $_COOKIE into one array. [S1]
• Security caveat — combining sources makes it harder to know a value's origin, a potential vulnerability; prefer the specific superglobals when possible. [S1]
• htmlspecialchars() — sanitizes output to prevent XSS when echoing user-submitted data. [S1]
• Works for both POST forms and GET query strings/forms — the same $_REQUEST[key] syntax retrieves data regardless of submission method. [S1]

📖 세부 내용 (Details)

• POST form + $_REQUEST: <form method="post" action="...">... <?php $name = htmlspecialchars($_REQUEST['fname']); ?>. [S1]
• GET query string + $_REQUEST(via $_GET in this example): <a href="demo_phpfile.php?subject=PHP&web=W3schools.com">Test $GET</a> then $subject = htmlspecialchars($_GET['subject']);. [S1]
• Self-submitting form pattern: <form method="post" action="<?php echo $_SERVER['PHP_SELF'];?>">. [S1]

⚖️ 모순 및 업데이트 (Contradictions & updates)

• $_REQUEST의 보안 취약점: GET/POST/COOKIE를 한데 섞기 때문에 값의 출처를 구분하기 어려워 보안 취약점이 될 수 있으며, 가능하면 구체적인 슈퍼글로벌을 쓰라고 권장됨. [S1]

🛠️ 적용 사례 (Applied in summary)

현재 발견된 실제 적용 사례가 없습니다 — htmlspecialchars()로 사용자 입력을 이스케이프해 XSS를 방지하는 것이 필수 보안 관행이다. [S1]

💻 코드 패턴 (Code patterns)

Sanitizing form input with htmlspecialchars() (PHP):

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $name = htmlspecialchars($_REQUEST['fname']);
    echo empty($name) ? "Name is empty" : $name;
}

✅ 검증 상태 및 신뢰도

• 상태: draft
• 검증 단계: conceptual
• 출처 신뢰도: B (W3Schools — widely used educational reference, not a primary standards body)
• 신뢰 점수: 0.88
• 중복 검사 결과: 신규 생성 (New discovery)

🔗 지식 그래프 (Knowledge Graph)

• 상위/루트: PHP Tutorial
• 관련 개념: PHP Superglobals Post, PHP Superglobals Get, PHP Form Validation
• 참조 맥락: 통합 요청 데이터 접근 — $_POST 챕터로 이어짐.

📚 출처 (Sources)

• [S1] W3Schools — PHP $_REQUEST Superglobal — https://www.w3schools.com/php/php_superglobals_request.asp

📝 변경 이력 (Change history)

• 2026-07-04: Initial draft synthesized from the W3Schools "PHP $_REQUEST Superglobal" page (Astra wiki-curation, P-Reinforce v3.1 format).