Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
They answer different questions. ($_SERVER['REQUEST_METHOD'] ?? '') === 'POST' checks whether the HTTP request used POST. isset($_POST['submit']) checks whether the request included a non-null parameter named submit. To detect POST requests generally, use the request-method check; use a named field to identify a particular form or action.
First, the correct syntax
isset['submit'] is not valid PHP. isset is a language construct that takes its argument in parentheses. To check a POST parameter, write:
isset($_POST['submit'])A complete conditional would be:
if (isset($_POST['submit'])) {
// A non-null POST parameter named "submit" was received.
}That condition does not check the parameter’s value. If the value matters, compare it explicitly:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
if (($_POST['submit'] ?? '') === 'Save') {
// The parameter's value is exactly "Save".
}isset() returns true when the variable or array element exists and is not null. It does not validate the value or prove who sent it. See PHP’s documentation for isset().
#1 Best Overall
What the request-method check tells you
PHP exposes the HTTP method in $_SERVER['REQUEST_METHOD']. Prefer strict comparison and provide a fallback in case the key is unavailable:
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
// This request used the POST method.
}This establishes only that the request method was POST. It does not establish that a particular form was used, that expected fields arrived, or that any values are valid. A POST can come from an HTML form, JavaScript, an API client, a mobile app, a command-line tool, or another automated client. PHP documents REQUEST_METHOD among the $_SERVER variables.
So use precise language: a POST request reached the script. Do not treat the method alone as proof that a trusted user submitted a complete form.
Rank #2
What a submit-button parameter tells you
A browser generally submits a form control’s name and value when that control is a successful control in the submission. For example:
<button type="submit" name="submit" value="save">Save</button>When that control is included, PHP may receive $_POST['submit'] with the value save. But a button without a name does not create that parameter:
<button type="submit">Save</button>HTML form data is built from the controls included in a particular submission; see the HTML Standard’s form-data construction rules. The presence of a button parameter is therefore about a particular control, not a general signal that the server received a form request.
Why not use the button as the general submission test?
- Keyboard submission: A user may submit by pressing Enter. Depending on the form and how it is submitted, the expected button name and value may not be present.
- Disabled controls: Disabled controls are not included in submitted form data, so a disabled button does not provide a reliable flag.
- Several submit buttons: The parameter might identify a choice, but you must inspect its value to know which operation was requested.
- JavaScript or other clients: A script can send a POST without including any submit-button field. A direct client can send arbitrary fields.
- Missing or unparsed data: A POST can have an empty body, an unexpected content type, or a body PHP cannot parse as expected. The absence of
$_POST['submit']does not show that no POST occurred.
These cases are why isset($_POST['submit']) is insufficient as a general POST detector. It can still be useful when you deliberately want to check for a particular parameter.
A practical pattern for one form
Check the method first, then read, validate, and process the fields the application actually needs:
<form method="post" action="/contact.php">
<label>
Name
<input type="text" name="name" required>
</label>
<button type="submit">Send</button>
</form><?php
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
$name = trim((string) ($_POST['name'] ?? ''));
if ($name === '') {
$error = 'Name is required.';
} else {
// Process the validated name.
header('Location: /success.php', true, 303);
exit;
}
}
?>The ?? operator supplies a fallback when a key is missing, avoiding an undefined-key warning. Validation is still necessary: an input’s presence does not make its contents acceptable. After successful processing, redirecting and exiting is a common way to prevent accidental reprocessing on refresh; PHP documents the header() function.
Rank #4
Several forms or actions on one endpoint
Detect POST at the request level, then use an explicit action value to select the intended operation. A hidden field is one straightforward option:
<form method="post" action="/account.php">
<input type="hidden" name="action" value="login">
<input type="email" name="email" required>
<input type="password" name="password" required>
<button type="submit">Log in</button>
</form><?php
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
$action = $_POST['action'] ?? '';
switch ($action) {
case 'login':
// Validate credentials, then process login.
break;
case 'register':
// Validate registration fields, then process registration.
break;
default:
http_response_code(400);
exit('Unknown form action.');
}
}
?>You can also use distinct submit-button values for multiple operations, such as name="action" value="save" and value="preview". In that case, inspect the value; merely checking isset($_POST['action']) does not tell you which action was chosen. Hidden fields are client-controlled too, so never treat one as authorization or trust it without validation.
POST method and request-body parsing are separate
For conventional HTML forms, PHP typically places URL-encoded or multipart form fields in $_POST. A JSON request is different: checking the method may still identify POST, but JSON fields will not normally appear in $_POST. Read and decode the raw body instead:
$raw = file_get_contents('php://input');
$data = json_decode($raw, true);For robust code, check the content type, handle malformed JSON, and validate the decoded structure before using it. PHP documents $_POST, php://input, and json_decode().
Likewise, file uploads are handled through $_FILES, with upload status and configuration considerations; see PHP’s file upload documentation. Request-size limits, including post_max_size, can also affect parsed form data (PHP core configuration). An endpoint should handle missing or unusable input deliberately rather than infer that no POST took place.
Neither check is a security control
Both the request method and every submitted field are controlled by the client. Neither REQUEST_METHOD === 'POST' nor isset() provides authentication, authorization, CSRF protection, or input validation. Validate values on the server, check permissions for the requested operation, and use CSRF defenses where relevant. For database writes, use prepared statements rather than building SQL from request values. See the OWASP guidance on input validation, authorization, and CSRF, plus PHP’s documentation on PDO prepared statements.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhich check should you use?
| What you need to know | Use |
|---|---|
| Did this request use POST? | ($_SERVER['REQUEST_METHOD'] ?? '') === 'POST' |
| Was a particular non-null parameter sent? | isset($_POST['field']) |
| Which operation was requested? | An explicit action value, checked against allowed values |
| Is required text missing or blank? | Read with a fallback, trim, then compare with '' |
| Is a checkbox present? | isset($_POST['checkbox_name']), followed by any needed semantic checks |
| Is this a JSON request? | Check method and content type, then parse php://input |
| Was a file upload attempted? | Inspect $_FILES and its upload error code |
Do not substitute !empty() automatically when checking values: PHP considers the string "0" empty, which may be valid input in some contexts. Choose validation based on what the field is meant to contain; see PHP’s empty() semantics and filter functions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
