Retrieves a parameter from the request.
Parameters
$keystringrequired- Parameter name.
Source
public function get_param( $key ) {
$order = $this->get_parameter_order();
foreach ( $order as $type ) {
// Determine if we have the parameter for this type.
if ( isset( $this->params[ $type ][ $key ] ) ) {
return $this->params[ $type ][ $key ];
}
}
return null;
}
Changelog
| Version | Description |
|---|---|
| 4.4.0 | Introduced. |
get_param() checks parameter sources in this priority order (from get_parameter_order()): JSON body > POST body > GET query string > URL route params > registered defaults. The first source that HAS the key wins — even if that source is less “authoritative” than you’d expect.
The gotcha: parameters captured by your route’s regex (e.g. the id in ‘/wpdocs/v1/users/(?P\d+)’) are checked SECOND TO LAST, after the query string. So a request to:
/wp-json/wpdocs/v1/users/5?id=999
…will have $request->get_param( ‘id’ ) return 999 (from the query string), NOT 5 (from the URL route). The same applies to a JSON body containing {“id”: 999} sent to that same URL.
This matters if your code reads the same key in two different places and assumes they’ll agree — for example, doing a permission check against $request->get_url_params()[‘id’] (or the URL structure itself) but then using $request->get_param( ‘id’ ) for the actual database operation. Since the two can diverge, this pattern can lead to acting on a different resource than the one that was permission-checked.
To avoid this, be explicit about which source you actually mean:
// Only trust what the route regex captured, ignore query/body entirely.
$id = $request->get_url_params()[‘id’] ?? null;
// Or, if you specifically want query-string input, be explicit:
$id = $request->get_query_params()[‘id’] ?? null;
Reserve get_param() for cases where you genuinely want “whichever source provides this key first,” and use the specific getter (get_url_params(), get_query_params(), get_body_params(), get_json_params()) whenever the source matters — especially for any value used in a permission check or database query.