Serving HTTP Requests · PHP — interview questions

In PHP, how do HTML form field names become $_POST keys, and what do name[] and name[key] produce?

juniormust knowfreq 68%

answer

the name attribute, not the id
values always arrive as strings
name[] appends like $a[]
repeated plain name: last pair wins
multi-select without [] loses options

basics

~20 s

Each submitted control's name attribute becomes a $_POST key holding a string. A name ending in [] appends to a list, name[key] sets that key, and a repeated plain name keeps only its last value, so multi-selects need name[].

solid answer

~40 s

Before the script runs, PHP parses the POST body into $_POST, using each control's name attribute as the key; the id plays no part, and a control with no name or a disabled one is never sent. Every value is a string, even from a number input, so ward=4 arrives as "4". Brackets build arrays with the same logic as PHP's own array syntax: topics[] appends at the next integer index, resident[name] writes the key name, and they nest (answers[q1][]). A plain name that appears twice simply overwrites itself, which is why <select multiple name="district"> delivers only the last selected option; name it district[]. Because the client controls the names, read defensively: $_POST['topics'] ?? [], and check is_array() or is_string() before use.

Before the script runs, PHP parses the POST body into `$_POST`, using each control's `name` attribute as the key; the `id` plays no part, and a control with no name or a `disabled` one is never sent. Every value is a **string**, even from a number input, so `ward=4` arrives as `"4"`. Brackets build arrays with the same logic as PHP's own array syntax: `topics[]` appends at the next integer index, `resident[name]` writes the key `name`, and they nest (`answers[q1][]`). A plain name that appears twice simply overwrites itself, which is why `<select multiple name="district">` delivers only the last selected option; name it `district[]`. Because the client controls the names, read defensively: `$_POST['topics'] ?? []`, and check `is_array()` or `is_string()` before use.

code

php · 18 lines

php

<?php
declare(strict_types=1);

// parse_str() applies the same name-to-key rules that fill $_POST
$body = 'resident[name]=Ana&resident[ward]=4'
      . '&topics[]=parks&topics[]=transit'
      . '&district=north&district=south';
parse_str($body, $post);

var_dump($post['resident']['ward']); // string(1) "4"
var_dump($post['topics']);           // [0 => 'parks', 1 => 'transit']
var_dump($post['district']);         // string(5) "south" - last pair wins

// Reading a checkbox group defensively
$topics = $_POST['topics'] ?? [];
if (!is_array($topics)) {
    $topics = [];
}

go deeper

for a junior

Recall that the name attribute becomes the key, values are strings, and name[] or name[key] turn a field into an array. Know that a multi-select needs brackets.

for a middle

Explain the last-pair-wins rule for repeated plain names, how nested brackets map to nested arrays, and why a key can be absent entirely.

for a senior

Show that request shape is attacker-controlled: an array where a string was expected throws TypeError in PHP 8, so handlers check shape before using values.

for a principal

Argue for one input-mapping layer that turns $_POST into typed objects, so no handler reads raw superglobals and shape checks live in one place.

From a submitted form to `$_POST`

When a browser submits a form with method="post" and the default application/x-www-form-urlencoded encoding (or multipart/form-data), it sends each successful control as a name=value pair. PHP parses that body during request startup, before the first line of your script executes, and stores each pair in the superglobal array $_POST.

The key is always the control's name attribute. The id, the <label> text and the placeholder are never sent. Which controls count as successful is decided by the browser:

text inputs, textareas, hidden inputs and selected radio buttons send their value, even when it is empty ("");
a checkbox or an <option> is sent only when it is checked or selected;
a submit button is sent only if it has a name and is the one that was clicked;
a control with no name, or with the disabled attribute, is not sent at all.

Plain names: one key, one string

A field named ward becomes $_POST['ward']. Its value is a string, whatever the input type: a type="number" field holding 4 arrives as "4", not int(4). Converting and validating it is your job.

If two pairs share the same plain name, PHP writes the second over the first: the last pair wins. The body district=north&district=south leaves $_POST['district'] === 'south', with no warning.

Brackets build arrays

PHP reads square brackets in a field name the way it reads them in code:

`name` attribute	Resulting value in `$_POST`
`topics[]` (on several checkboxes)	`$_POST['topics']` is a list: keys `0`, `1`, … in document order
`resident[name]` and `resident[ward]`	`$_POST['resident']` is `['name' => ..., 'ward' => ...]`
`score[3]`	integer key `3` (a canonical decimal string becomes an int key)
`answers[q1][]`	a nested list under `$_POST['answers']['q1']`
`district` repeated, no brackets	a single string, the last value sent

So [] behaves like $a[] = $v (append at the next integer index) and [key] like $a['key'] = $v. You can mix them: contact[], contact[], contact[email] yields keys 0, 1 and email.

Multi-selects and checkbox groups

A <select multiple> sends one pair per selected option, all under the same name. Named district, only the last option survives; named district[], $_POST['district'] is a list of every selection. A group of checkboxes that should allow several answers works the same way: give them all the same name ending in [] and distinct value attributes.

If the user selects nothing, the browser sends no pair at all, so the key is absent rather than an empty array.

A worked example: the council survey

Picture a city council survey with a resident block, a group of topic checkboxes and a district multi-select:

resident[name] and resident[ward] - two text inputs grouped under one key;
topics[] on five checkboxes with values parks, transit, housing, libraries, safety;
district[] on a <select multiple>;
comment on a textarea.

A resident who fills in a name and ward, ticks parks and transit, picks two districts and leaves the comment empty produces $_POST['resident'] with two string keys, $_POST['topics'] as ['parks', 'transit'], $_POST['district'] as a two-element list, and $_POST['comment'] as "". A resident who ticks no topic produces no topics key at all. The handler therefore reads each part with its own default and shape check rather than assuming the full structure is present.

Reading the result defensively

The client chooses the names, so the shape of $_POST is not guaranteed. Three situations to handle:

Missing key - nothing selected, or a field the form did not render. Use $_POST['topics'] ?? [] rather than reading the key directly, which in PHP 8 raises an "Undefined array key" warning.
An array where you expect a string - anyone can post ward[]=4. In PHP 8, passing that array to trim() throws a TypeError, because internal functions now reject wrong-typed arguments instead of returning null.
A string where you expect an array - someone posts topics=parks. Check with is_array() before looping.

Validating the actual values (allowed choices, integer ranges) and escaping them when you print them back are separate steps with their own tools. The name-to-key rules above apply equally to $_GET for query strings.

## From a submitted form to `$_POST` When a browser submits a form with `method="post"` and the default `application/x-www-form-urlencoded` encoding (or `multipart/form-data`), it sends each **successful control** as a `name=value` pair. PHP parses that body during request startup, before the first line of your script executes, and stores each pair in the superglobal array `$_POST`. The key is always the control's **`name` attribute**. The `id`, the `<label>` text and the placeholder are never sent. Which controls count as successful is decided by the browser: - text inputs, textareas, hidden inputs and selected radio buttons send their value, even when it is empty (`""`); - a checkbox or an `<option>` is sent only when it is checked or selected; - a submit button is sent only if it has a name and is the one that was clicked; - a control with no `name`, or with the `disabled` attribute, is not sent at all. ## Plain names: one key, one string A field named `ward` becomes `$_POST['ward']`. Its value is a **string**, whatever the input type: a `type="number"` field holding 4 arrives as `"4"`, not `int(4)`. Converting and validating it is your job. If two pairs share the same plain name, PHP writes the second over the first: the **last pair wins**. The body `district=north&district=south` leaves `$_POST['district'] === 'south'`, with no warning. ## Brackets build arrays PHP reads square brackets in a field name the way it reads them in code: | `name` attribute | Resulting value in `$_POST` | |---|---| | `topics[]` (on several checkboxes) | `$_POST['topics']` is a list: keys `0`, `1`, … in document order | | `resident[name]` and `resident[ward]` | `$_POST['resident']` is `['name' => ..., 'ward' => ...]` | | `score[3]` | integer key `3` (a canonical decimal string becomes an int key) | | `answers[q1][]` | a nested list under `$_POST['answers']['q1']` | | `district` repeated, no brackets | a single string, the last value sent | So `[]` behaves like `$a[] = $v` (append at the next integer index) and `[key]` like `$a['key'] = $v`. You can mix them: `contact[]`, `contact[]`, `contact[email]` yields keys `0`, `1` and `email`. ## Multi-selects and checkbox groups A `<select multiple>` sends one pair per selected option, all under the same name. Named `district`, only the last option survives; named `district[]`, `$_POST['district']` is a list of every selection. A group of checkboxes that should allow several answers works the same way: give them all the same `name` ending in `[]` and distinct `value` attributes. If the user selects nothing, the browser sends no pair at all, so the key is **absent** rather than an empty array. ## A worked example: the council survey Picture a city council survey with a resident block, a group of topic checkboxes and a district multi-select: - `resident[name]` and `resident[ward]` - two text inputs grouped under one key; - `topics[]` on five checkboxes with values `parks`, `transit`, `housing`, `libraries`, `safety`; - `district[]` on a `<select multiple>`; - `comment` on a textarea. A resident who fills in a name and ward, ticks parks and transit, picks two districts and leaves the comment empty produces `$_POST['resident']` with two string keys, `$_POST['topics']` as `['parks', 'transit']`, `$_POST['district']` as a two-element list, and `$_POST['comment']` as `""`. A resident who ticks no topic produces **no** `topics` key at all. The handler therefore reads each part with its own default and shape check rather than assuming the full structure is present. ## Reading the result defensively The client chooses the names, so the shape of `$_POST` is not guaranteed. Three situations to handle: 1. **Missing key** - nothing selected, or a field the form did not render. Use `$_POST['topics'] ?? []` rather than reading the key directly, which in PHP 8 raises an "Undefined array key" warning. 2. **An array where you expect a string** - anyone can post `ward[]=4`. In PHP 8, passing that array to `trim()` throws a `TypeError`, because internal functions now reject wrong-typed arguments instead of returning `null`. 3. **A string where you expect an array** - someone posts `topics=parks`. Check with `is_array()` before looping. Validating the actual values (allowed choices, integer ranges) and escaping them when you print them back are separate steps with their own tools. The name-to-key rules above apply equally to `$_GET` for query strings.

In PHP 8, what happens if someone renames the field ward to ward[] and your code calls trim($_POST['ward'])?
`$_POST['ward']` is now an array, and `trim()` declares a `string` parameter, so PHP 8 throws a `TypeError` ("trim(): Argument #1 ($string) must be of type string, array given"). Uncaught, that is a 500 error. Before PHP 8.0 it emitted a warning and returned `null`. Check the shape with `is_string()` or a filter function before calling string functions on request data.
Does a field named score[03] produce the integer key 3 in $_POST?
No. PHP converts a bracket key to an integer only when it is a canonical decimal integer string, the same rule array literals use. `score[3]` gives int key `3`; `score[03]` and `score[3.0]` keep the string keys `"03"` and `"3.0"`.
Do these naming rules apply to $_GET as well?
Yes. A form with `method="get"` puts the same pairs in the query string, and PHP parses them into `$_GET` with the same rules: brackets build arrays, a repeated plain name keeps the last value, and every value is a string.

saying these in an interview costs you the question

PHP uses the input's id attribute as the $_POST key.
A number input arrives in $_POST as an int.
A multi-select named district delivers every selected option as an array.
Repeating a plain field name makes PHP collect the values into an array.
Every field rendered in the form always has a key in $_POST.

§explore

▾sections5 · 27 questions

▾roadmaps that cover this1

§questions

In PHP, how do HTML form field names become $_POST keys, and what do name[] and name[key] produce?

§ answer

basics

solid answer

code

§ go deeper

▾level notes4 levels

▾deep dive~4 min

From a submitted form to $_POST

Plain names: one key, one string

Brackets build arrays

Multi-selects and checkbox groups

A worked example: the council survey

Reading the result defensively

▾common follow-ups3 questions

▾red flags5 flags

In PHP, what causes the "Cannot modify header information - headers already sent" warning, and how do you fix it?

basics

In PHP, why must header('Location: ...') be followed by exit, and which status code does the redirect send?

basics

In PHP, what does session_start() actually do, and how does $_SESSION data survive from one request to the next?

basics

In PHP, how do setcookie() and $_COOKIE work together, and why is a cookie you just set missing from $_COOKIE?

basics

In PHP, what is the difference between $_GET and $_POST, and when is each of them populated?

basics

In PHP, what does a form need to upload a file, what does $_FILES hold, and how do you keep the file?

basics

In a PHP form handler, what problem does Post/Redirect/Get solve, and how do you redisplay validation errors with it?

basics

In PHP, what do session_regenerate_id() and session.use_strict_mode each protect against, and what are their defaults?

basics

Why is $_POST empty when a payment provider posts a JSON webhook to a PHP endpoint, and how do you read that body?

basics

In PHP, why shouldn't an upload handler trust $_FILES['cv']['type'] or the file's extension, and how do you check the real type?

basics

In PHP, why is an unchecked checkbox missing from $_POST, and how do you read it reliably as a boolean?

basics

In PHP, how do ob_start(), ob_get_clean() and ob_end_flush() work, and what does the output_buffering ini directive change?

basics

In PHP, what does header()'s $replace argument do, and how do header_remove() and http_response_code() change a pending response?

basics

In PHP 8.5, which session ini settings do you change from their defaults to harden the session cookie, and where do you set them?

basics

In PHP, what does $_REQUEST contain, how does request_order control it, and why do most codebases avoid it?

basics

In PHP, how do HTTP request headers appear in $_SERVER, and why is Content-Type read from CONTENT_TYPE instead?

basics

In PHP, what shape does $_FILES take for <input type="file" name="docs[]" multiple>, and how do you loop over the files?

basics

In PHP, which UPLOAD_ERR_* codes can $_FILES report, and what does each tell an upload handler to do?

basics

A PHP admin form with 60 rows of 20 fields saves only the first rows and shows no error; how do you diagnose and fix it?

basics

A PHP admin panel's CSV export of 500,000 rows exhausts memory or arrives only at the end; how do you stream it as a download?

basics

A PHP shopping-basket page fires four AJAX requests at once, yet they finish one after another instead of in parallel; why, and how do you fix it?

basics

In PHP, which $_SERVER entries can a client control, and which can you rely on — REMOTE_ADDR, HTTP_HOST, SERVER_NAME, PHP_SELF?

basics

A PHP job form with upload_max_filesize = 10M accepts a 5 MB CV, but a 9 MB CV arrives with $_POST and $_FILES both empty; why?

basics

In PHP, what happens to form field names with dots or spaces, and to names like rows[][name] and rows[][email]?

basics

In PHP 8.4 and later, what does request_parse_body() do, and why do PUT and PATCH form submissions need it?

basics

In PHP, how do you implement and register a custom session save handler with SessionHandlerInterface, and what must it handle itself?

basics

From a submitted form to $_POST

Plain names: one key, one string

Brackets build arrays

Multi-selects and checkbox groups

A worked example: the council survey

Reading the result defensively

explore

questions

answer

go deeper

From a submitted form to `$_POST`

From a submitted form to `$_POST`