Request superglobals in controllers should be replaced with `ServerRequest` object

Instead of getting the request parameters from superglobals ($_POST, $_GET and $_REQUEST) in controllers, they should be got from the PhpMyAdmin\Http\ServerRequest object that is available for all controllers.

Controllers have a method called __invoke that has a signature like the following:

public function __invoke(ServerRequest $request): void

So if the controller gets a parameter from the $_POST superglobal, it can be replaced to get from the $request variable. For example:

- $param = $_POST['param'] ?? null;
+ $param = $request->getParsedBodyParam('param');

- $value = $_POST['value'] ?? 'default';
+ $value = $request->getParsedBodyParam('value', 'default');

Or from the $_GET superglobal:

- $param = $_GET['param'] ?? null;
+ $param = $request->getQueryParam('param');

- $value = $_GET['value'] ?? 'default';
+ $value = $request->getQueryParam('value', 'default');

If you want to get from $_POST or from $_GET:

- $param = $_POST['param'] ?? $_GET['param'] ?? null;
+ $param = $request->getParam('param');

- $value = $_POST['param'] ?? $_GET['value'] ?? 'default';
+ $value = $request->getParam('value', 'default');

You can also get all the request parameters. For example:

- $getParams = $_GET;
+ $getParams = $this->getQueryParams();

- $postParams = $_POST;
+ $postParams = $this->getParsedBody();

Note
Please be careful that while the $_POST and $_GET are global variables, the ServerRequest is a immutable object.
So, if you encounter something like this in code:

$_POST['param'] = 'new value';

You should first find all places in the code that uses this parameter and refactor the code to not write on the global variable.

• Related to https://github.com/phpmyadmin/phpmyadmin/issues/16276
• Related to https://github.com/phpmyadmin/phpmyadmin/issues/15507

Start in libraries/classes/Controllers and inspect each __invoke(ServerRequest $request) entry point, using libraries/classes/Http/ServerRequest.php to understand the available accessors. Search the controllers for $_POST, $_GET, and $_REQUEST, then trace any writes before changing reads. Done means controller request parameters come through ServerRequest without unsafe global mutations.