Why is variable value emptry in $_POST but available in $_REQUEST?

Question

I'm trying to add a custom meta box to my theme by following the tutorial : https://www.sitepoint.com/adding-meta-boxes-post-types-wordpress/.

I can see the meta box and It gets the value from database (tried by manually updating the post-meta). However, it never gets updated. I tried debugging by var_dump(ing) the $_POST array, it shows that the variable value is empty, but the value is present in $_REQUEST. Does anyone know the reason for this?

The missing variable is called post-excerpt. Here is my code.

function buziness_add_custom_box() {
// Adding layout meta box for page
 add_meta_box(
    'offer-post-excerpt',
    esc_html__( 'Excerpt', 'buziness'),
    'buziness_post_excerpt',
    'post',
    'normal',
    'default'
 );
}

Next is the callback function:

function buziness_post_excerpt($post){
// Add a nonce field so we can check for it later
// Use nonce for verification
wp_nonce_field( basename( __FILE__ ) , 'custom_excerpt_nonce' );

$value = get_post_meta($post->ID, '_excerpt', true );

echo '<textarea style="width:100%" id="post_excerpt" name="post_excerpt">' . esc_attr( $value ) . '</textarea>';
echo "<p>Excerpts are optional hand-crafted summaries of your content that can be used in your theme</p>";

}

This is the function hooked to save_post hook

add_action('save_post', 'buziness_save_post_excerpt');
/**
* save the custom excerpt metabox data
* @hooked to save_post hook
*/
function buziness_save_post_excerpt($post_id) {
    // Checks save status

    var_dump($_POST);
    var_dump($_REQUEST);
    wp_die($_REQUEST);
    $is_autosave = wp_is_post_autosave( $post_id );

    $is_valid_nonce = ( isset( $_POST[ 'custom_excerpt_nonce' ] ) && wp_verify_nonce( $_POST[ 'custom_excerpt_nonce' ], basename( __FILE__ ) ) ) ? 'true' : 'false';

    // Exits script depending on save status
    if ( $is_autosave || !$is_valid_nonce ) {
       return;
    }

    // Check the user's permissions.
    if ( isset( $_POST['post_type'] ) && 'post' == $_POST['post_type'] ) {

        if ( ! current_user_can( 'edit_page', $post_id ) ) {
           return;
       }

   }
   else {

        if ( ! current_user_can( 'edit_post', $post_id ) ) {
            return;
        }
   }


   // Checks for input and sanitizes/saves if needed
   if( isset( $_POST[ 'post_excerpt' ] ) ) {
       update_post_meta( $post_id, '_excerpt', sanitize_text_field( $_POST[ 'post_excerpt' ] ) );
   }
}

Here is the part of output from var_dump($_POST)

'ping_status' => string 'open' (length=4)
'add_comment_nonce' => string 'c641d598b3' (length=10)
'_ajax_fetch_list_nonce' => string '1e9f1f3f06' (length=10)
'post_name' => string 'online-training' (length=15)
'post_author_override' => string '1' (length=1)
'custom_excerpt_nonce' => string '0cd0a833c4' (length=10)
'post_excerpt' => string '' (length=0)
'post_mime_type' => string '' (length=0)
'ID' => int 96

and the part of output from var_dump($_REQUEST)

'ping_status' => string 'open' (length=4)
'add_comment_nonce' => string 'c641d598b3' (length=10)
'_ajax_fetch_list_nonce' => string '1e9f1f3f06' (length=10)
'post_name' => string 'online-training' (length=15)
'post_author_override' => string '1' (length=1)
'custom_excerpt_nonce' => string '0cd0a833c4' (length=10)
'post_excerpt' => string 'TES t ' (length=6)

As you can see, the value of 'post_excerpt' is empty in the output of $_POST.

Answer 1

Using $_REQUEST is a bad practice. Between post requests, get requests, and cookies you can not be certain that you are processing actual user input and not some garbage left in the URL or in the browser's memory.

Meta boxes are "posted" so use only $_POST when processing them.

The other aspect of your code is that you are trying to access things which are not belonging to "your code". Always prefer to use whatever API there is for that instead of trying to access them from global places. While I do not see any reason why would anyone do it, someone at some point will probably have a great idea of removing some values from $_POST because of some imaginary (or less imaginary) reason. In addition APIs like save handlers will be called to handle "saves" which were not originated from a browser at all, at which case those global variables might be empty or contain garbage.

Ohhhhhhhhhhhhh you are using names for your fields which are not prefixed in any way. It is a big can of worms by itself. Always prefix everything which is in global scope.