PHP Superglobals Quiz

What is the primary reason reviewers warn against accessing $_GET values directly inside deeply nested logic?

What does this snippet echo when visiting /page.php?name=Nova?

<?php
echo htmlspecialchars($_GET['name'] ?? 'Guest', ENT_QUOTES, 'UTF-8');
?>

Why do security guides discourage merging $_GET and $_POST via $_REQUEST for sensitive endpoints?

What does this POST-handling snippet echo when $_POST["email"] is missing?

<?php
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
echo $email === null ? 'no field' : ($email === false ? 'invalid' : 'ok');
?>

Why should $_SERVER["HTTP_REFERER"] never be used directly for authorization decisions?

What will this script echo if the request method is POST?

<?php
echo $_SERVER['REQUEST_METHOD'] === 'POST' ? 'process' : 'skip';
?>

Why does $_FILES require checking both error codes and mime type rather than trusting user-provided filenames?

What does this upload check output if $_FILES["avatar"]["error"] equals UPLOAD_ERR_NO_FILE?

<?php
$file = $_FILES['avatar'] ?? null;
if (!$file || $file['error'] === UPLOAD_ERR_NO_FILE) {
    echo 'missing';
} else {
    echo 'got file';
}
?>

Why should $_SESSION writes happen before output buffering is flushed?

What does this session snippet echo on first load?

<?php
session_start();
if (!isset($_SESSION['visits'])) {
    $_SESSION['visits'] = 0;
}
$_SESSION['visits']++;
echo $_SESSION['visits'];
?>

Why do hardening guides discourage writing arbitrary keys into $GLOBALS?

What does this $GLOBALS access echo?

<?php
$token = 'abc';
function showToken() {
    echo $GLOBALS['token'] ?? 'none';
}
showToken();
?>

Why is putenv/getenv usage typically wrapped in helper functions instead of scattered throughout the app?

What does this getenv snippet echo if MY_FLAG is missing?

<?php
$flag = getenv('MY_FLAG');
echo $flag === false ? 'unset' : $flag;
?>

Why should developers use filter_input instead of raw $_GET/$_POST when sanitizing numerical query parameters?

What does this CLI-focused script echo when run as php task.php foo bar?

<?php
echo $_SERVER['argv'][1] ?? 'none';
?>

Why do documentation templates remind developers to check $_SERVER["HTTPS"] or $_SERVER["REQUEST_SCHEME"] carefully before enforcing redirects?

What does this HTTPS check echo on a secure request with $_SERVER["HTTPS"]="on"?

<?php
$isSecure = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
echo $isSecure ? 'secure' : 'plain';
?>

Why does $_COOKIE access typically pair with isset checks even if default values are provided elsewhere?

What does this cookie snippet echo if "lang" is not set?

<?php
$lang = $_COOKIE['lang'] ?? 'en';
echo $lang;
?>

Why is it unsafe to trust $_SERVER["REMOTE_ADDR"] for rate limiting behind reverse proxies?

What does this snippet echo when REMOTE_ADDR is 192.0.2.1?

<?php
$ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
echo $ip;
?>

Why should $_FILES["file"]["tmp_name"] be passed to move_uploaded_file rather than copying the original name?

What does this file-move snippet echo when the upload succeeds?

<?php
$file = $_FILES['avatar'] ?? null;
if ($file && $file['error'] === UPLOAD_ERR_OK) {
    echo move_uploaded_file($file['tmp_name'], __DIR__ . '/uploads/' . basename($file['name'])) ? 'saved' : 'failed';
} else {
    echo 'invalid';
}
?>

Why should $_SERVER["HTTP_HOST"] be sanitized before embedding into redirects or HTML titles?

What does this host validation snippet echo for a trusted host list ["app.test","admin.test"] if HTTP_HOST is admin.test?

<?php
$allowed = ['app.test', 'admin.test'];
$host = $_SERVER['HTTP_HOST'] ?? '';
echo in_array($host, $allowed, true) ? 'trusted' : 'reject';
?>

Why is $_ENV typically populated only when variables_order includes "E" in php.ini?

What does this script echo if variables_order omits "E" and $_ENV is empty while getenv works?

<?php
$env = $_ENV['MODE'] ?? getenv('MODE') ?? 'default';
echo $env;
?>

Why do tests often seed $_SERVER, $_GET, and $_POST manually before including controller files?

What does this test helper echo when $_POST["token"]="abc", $_SERVER["REMOTE_ADDR"]="127.0.0.1", and $_SERVER["HTTP_X_FORWARDED_FOR"] is unset?

<?php
$_POST['token'] = 'abc';
$_SERVER['REMOTE_ADDR'] = '127.0.0.1';
unset($_SERVER['HTTP_X_FORWARDED_FOR']);
$token = $_POST['token'] ?? '';
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
echo $token . '@' . $ip;
?>