In PHP, read an ID in a URL such as edit.php?id=25 with $_GET['id']. To carry it with a form submission, add a named hidden field and read it on the receiving page with $_POST['id']. The field’s name determines the PHP key. In either case, treat the value as untrusted input: validate its format, confirm the record exists, and check that the current user is allowed to perform the requested action.
Get an ID from a URL in PHP
For a URL like edit.php?id=25, PHP makes the query-string value available as $_GET['id']. The PHP manual explains how external variables map to request keys in variables from external sources.
As an Amazon Associate I earn from qualifying purchases.
<?php
$id = $_GET['id'] ?? null;
?>This reads the value but does not establish that it is valid. Validate it according to the ID format your application uses before relying on it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Post an ID to another PHP page with a form
Use a form with method="post" and an input whose name matches the key you want to read in PHP. For example, name="id" becomes $_POST['id']; the HTML id attribute is used for labels, scripts, and styling, not as the submitted PHP key. See PHP’s documentation on form variables.
#1 Best Overall
<form action="update.php" method="post">
<input type="hidden" name="id" value="25">
<label for="title">Title</label>
<input id="title" name="title" type="text">
<button type="submit">Save</button>
</form>On the receiving page, read the submitted form value from $_POST:
<?php
$id = $_POST['id'] ?? null;
?>POST is the appropriate method when submitting a form that changes server state; PHP’s forms tutorial explains the choice in dealing with forms. GET is generally suited to a read or selection represented in the URL. Neither method validates an ID or proves that a user has permission.
Rank #2
Validate the ID on both pages
Request values are controlled by the requester. Validate them on the server, including on the receiving page, rather than relying on a hidden input or browser-side checks. filter_input() can apply a validation filter; with FILTER_VALIDATE_INT, it is suitable only when the application expects an integer. The function returns null when the value is absent and false when validation fails. Its default filter, FILTER_DEFAULT, performs no filtering. Details are in the PHP documentation for filter_input().
Recommended Free Tools
For an integer ID arriving in the URL, a page can validate it before displaying the form and escape it for the HTML attribute context:
<?php
$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if ($id === false || $id === null) {
http_response_code(400);
exit('Missing or invalid ID.');
}
?>
<form action="update.php" method="post">
<input type="hidden" name="id" value="<?= htmlspecialchars((string) $id, ENT_QUOTES, 'UTF-8') ?>">
<label for="title">Title</label>
<input id="title" name="title" type="text">
<button type="submit">Save</button>
</form>Then validate again in update.php, because the submitted value can be changed after the form is rendered:
<?php
$id = filter_input(INPUT_POST, 'id', FILTER_VALIDATE_INT);
if ($id === false || $id === null) {
http_response_code(400);
exit('Missing or invalid ID.');
}
// Fetch the record using a parameterized query.
// Check that the current user may edit it before making a change.
?>If your IDs are UUIDs or another format, use validation appropriate to that format instead of assuming a positive integer. HTML escaping prevents the value from breaking out of its attribute context; it does not validate the value or authorize an operation.
Rank #4
Check the record and permission before changing it
A well-formed ID may still refer to no record, or to a record the current user must not change. After validating the format, load the record with a parameterized database query, confirm it exists, and check authorization against the current user before an update, deletion, upload, or other protected action. A hidden field only carries the value; it is neither secret nor a permission check. PHP’s FAQ includes examples of carrying values in forms in PHP and HTML.
Choose GET or POST for the right kind of request
| Question | GET | POST |
|---|---|---|
| Typical PHP access | $_GET['id'] |
$_POST['id'] for URL-encoded or multipart form data |
| Where the value is carried | Query string in the URL | Request body |
| Common fit | Read or select a record | Submit an action that changes server state |
| What the method does not guarantee | Validity or permission | Validity or permission; POST is not access control |
PHP documents query-string and form-variable handling in variables from external sources and $_POST.
Quick Recap
When an ID does not arrive as expected
- The submitted key is missing: Check that the input has
name="id". Anid="id"attribute alone does not submit a PHP field namedid. - The value is in the wrong superglobal: A query parameter is read from
$_GET; a standard form submitted with POST is read from$_POST. - JSON is not available in
$_POST: PHP’s$_POSTcovers URL-encoded and multipart form bodies. For JSON or XML request bodies, PHP documents readingphp://input; see $_POST. - Validation accepts unexpected values: Specify an intentional validation filter.
FILTER_DEFAULTdoes not validate the ID format. - A valid-looking value still fails: Check whether the record exists and whether the current user is authorized to act on it; format validation alone cannot answer either question.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
