The $_REQUEST superglobal is a built-in PHP array that contains input data sent to the script via HTTP requests. It can include data from the $_GET, $_POST, and $_COOKIE superglobals.

Like all superglobals, $_REQUEST is always available in every scope, including inside functions.

The data inside $_REQUEST comes from external user input, such as:

• form submissions
• URL query strings
• cookies sent by the browser

Because $_REQUEST can combine data from multiple sources, the origin of a value is not always clear. The order in which PHP merges $_GET, $_POST, and $_COOKIE into $_REQUEST depends on server configuration (php.ini settings), so behavior may differ between environments.

For this reason, although $_REQUEST can be convenient for quick access, it is generally recommended to use the more specific superglobals ($_GET, $_POST, or $_COOKIE) when you know where the data should come from.

All data accessed through $_REQUEST should be validated and sanitized before use, as it represents untrusted user input and may expose security risks such as cross-site scripting (XSS).

In practice, $_REQUEST is useful for understanding how PHP receives request data, but explicit superglobals are preferred in real applications for clarity, safety, and predictability.