I am creating URL links with request form values (?a=b&c=d) in JavaScript and submitting to a PHP page. I am using encodeURIComponent in JavaScript to properly encode the form information.
I've already tested this and I've found that the values in $_REQUEST are already urldecode'd. So I've taken my urldecode calls out of my php, as they are redundant and potentially harmful for some input.
The purpose of this question is just to get some reassurance that I tested this correctly my understanding is correct, and that under normal conditions you don't need to explicitly call urldecode in php.
It is documented that $_GET is url decoded. There is no mention of this for the $_REQUEST global though.
https://www.php.net/manual/en/reserved.variables.get.php
The GET variables are passed through urldecode().
However from https://www.php.net/manual/en/reserved.variables.request.php:
An associative array that by default contains the contents of $_GET, $_POST and $_COOKIE
I think it can be inferred that something like array_mege is being used and so the GET values will be here decoded as well.