: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
* REST API: WP_REST_Request class
* Core class used to implement a REST request object.
* Contains data from the request, to be passed to the callback.
* Note: This implements ArrayAccess, and acts as an array of parameters when
* used in that manner. It does not use ArrayObject (as we cannot rely on SPL),
* so be aware it may have non-array behavior in some cases.
* Note: When using features provided by ArrayAccess, be aware that WordPress deliberately
* does not distinguish between arguments of the same name for different request methods.
* For instance, in a request with `GET id=1` and `POST id=2`, `$request['id']` will equal
* 2 (`POST`) not 1 (`GET`). For more precision between request methods, use
* WP_REST_Request::get_body_params(), WP_REST_Request::get_url_params(), etc.
* @link https://www.php.net/manual/en/class.arrayaccess.php
#[AllowDynamicProperties]
class WP_REST_Request implements ArrayAccess {
* Parameters passed to the request.
* These typically come from the `$_GET`, `$_POST` and `$_FILES`
* superglobals when being created from the global scope.
* @var array Contains GET, POST and FILES keys mapping to arrays of data.
* HTTP headers for the request.
* @var array Map of key to value. Key is always lowercase, as per HTTP specification.
protected $headers = array();
* @var string Binary data from the request.
* Route matched for the request.
* Attributes (options) for the route that was matched.
* This is the options array used when the route was registered, typically
* containing the callback as well as the valid methods for the route.
* @var array Attributes for the request.
protected $attributes = array();
* Used to determine if the JSON data has been parsed yet.
* Allows lazy-parsing of JSON data where possible.
protected $parsed_json = false;
* Used to determine if the body data has been parsed yet.
protected $parsed_body = false;
* @param string $method Optional. Request method. Default empty.
* @param string $route Optional. Request route. Default empty.
* @param array $attributes Optional. Request attributes. Default empty array.
public function __construct( $method = '', $route = '', $attributes = array() ) {
// See parse_json_params.
$this->set_method( $method );
$this->set_route( $route );
$this->set_attributes( $attributes );
* Retrieves the HTTP method for the request.
* @return string HTTP method.
public function get_method() {
* Sets HTTP method for the request.
* @param string $method HTTP method.
public function set_method( $method ) {
$this->method = strtoupper( $method );
* Retrieves all headers from the request.
* @return array Map of key to value. Key is always lowercase, as per HTTP specification.
public function get_headers() {
* Canonicalizes the header name.
* Ensures that header names are always treated the same regardless of
* source. Header names are always case insensitive.
* Note that we treat `-` (dashes) and `_` (underscores) as the same
* character, as per header parsing rules in both Apache and nginx.
* @link https://stackoverflow.com/q/18185366
* @link https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#missing-disappearing-http-headers
* @link https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers
* @param string $key Header name.
* @return string Canonicalized name.
public static function canonicalize_header_name( $key ) {
$key = strtolower( $key );
$key = str_replace( '-', '_', $key );
* Retrieves the given header from the request.
* If the header has multiple values, they will be concatenated with a comma
* as per the HTTP specification. Be aware that some non-compliant headers
* (notably cookie headers) cannot be joined this way.
* @param string $key Header name, will be canonicalized to lowercase.
* @return string|null String value if set, null otherwise.
public function get_header( $key ) {
$key = $this->canonicalize_header_name( $key );
if ( ! isset( $this->headers[ $key ] ) ) {
return implode( ',', $this->headers[ $key ] );
* Retrieves header values from the request.
* @param string $key Header name, will be canonicalized to lowercase.
* @return array|null List of string values if set, null otherwise.
public function get_header_as_array( $key ) {
$key = $this->canonicalize_header_name( $key );
if ( ! isset( $this->headers[ $key ] ) ) {
return $this->headers[ $key ];
* Sets the header on request.
* @param string $key Header name.
* @param string $value Header value, or list of values.
public function set_header( $key, $value ) {
$key = $this->canonicalize_header_name( $key );
$this->headers[ $key ] = $value;
* Appends a header value for the given header.
* @param string $key Header name.
* @param string $value Header value, or list of values.
public function add_header( $key, $value ) {
$key = $this->canonicalize_header_name( $key );
if ( ! isset( $this->headers[ $key ] ) ) {
$this->headers[ $key ] = array();
$this->headers[ $key ] = array_merge( $this->headers[ $key ], $value );
* Removes all values for a header.
* @param string $key Header name.
public function remove_header( $key ) {
$key = $this->canonicalize_header_name( $key );
unset( $this->headers[ $key ] );
* Sets headers on the request.
* @param array $headers Map of header name to value.
* @param bool $override If true, replace the request's headers. Otherwise, merge with existing.
public function set_headers( $headers, $override = true ) {
if ( true === $override ) {
$this->headers = array();
foreach ( $headers as $key => $value ) {
$this->set_header( $key, $value );
* Retrieves the Content-Type of the request.
* @return array|null Map containing 'value' and 'parameters' keys
* or null when no valid Content-Type header was
public function get_content_type() {
$value = $this->get_header( 'Content-Type' );
if ( strpos( $value, ';' ) ) {
list( $value, $parameters ) = explode( ';', $value, 2 );
$value = strtolower( $value );
if ( ! str_contains( $value, '/' ) ) {
// Parse type and subtype out.
list( $type, $subtype ) = explode( '/', $value, 2 );
$data = compact( 'value', 'type', 'subtype', 'parameters' );
$data = array_map( 'trim', $data );
* Checks if the request has specified a JSON Content-Type.
* @return bool True if the Content-Type header is JSON.
public function is_json_content_type() {
$content_type = $this->get_content_type();
return isset( $content_type['value'] ) && wp_is_json_media_type( $content_type['value'] );
* Retrieves the parameter priority order.
* Used when checking parameters in WP_REST_Request::get_param().
* @return string[] Array of types to check, in order of priority.
protected function get_parameter_order() {
if ( $this->is_json_content_type() ) {
$this->parse_json_params();
// Ensure we parse the body data.
$body = $this->get_body();
if ( 'POST' !== $this->method && ! empty( $body ) ) {
$this->parse_body_params();
$accepts_body_data = array( 'POST', 'PUT', 'PATCH', 'DELETE' );
if ( in_array( $this->method, $accepts_body_data, true ) ) {
* Filters the parameter priority order for a REST API request.
* The order affects which parameters are checked when using WP_REST_Request::get_param()
* and family. This acts similarly to PHP's `request_order` setting.
* @param string[] $order Array of types to check, in order of priority.
* @param WP_REST_Request $request The request object.
return apply_filters( 'rest_request_parameter_order', $order, $this );
* Retrieves a parameter from the request.
* @param string $key Parameter name.
* @return mixed|null Value if set, null otherwise.
public function get_param( $key ) {
$order = $this->get_parameter_order();
foreach ( $order as $type ) {
// Determine if we have the parameter for this type.
if ( isset( $this->params[ $type ][ $key ] ) ) {
return $this->params[ $type ][ $key ];
* Checks if a parameter exists in the request.
* This allows distinguishing between an omitted parameter,
* and a parameter specifically set to null.
* @param string $key Parameter name.
* @return bool True if a param exists for the given key.
public function has_param( $key ) {
$order = $this->get_parameter_order();
foreach ( $order as $type ) {
if ( is_array( $this->params[ $type ] ) && array_key_exists( $key, $this->params[ $type ] ) ) {
* Sets a parameter on the request.
* If the given parameter key exists in any parameter type an update will take place,
* otherwise a new param will be created in the first parameter type (respecting
* get_parameter_order()).
* @param string $key Parameter name.
* @param mixed $value Parameter value.
public function set_param( $key, $value ) {
$order = $this->get_parameter_order();
foreach ( $order as $type ) {
if ( 'defaults' !== $type && is_array( $this->params[ $type ] ) && array_key_exists( $key, $this->params[ $type ] ) ) {
$this->params[ $type ][ $key ] = $value;
$this->params[ $order[0] ][ $key ] = $value;
* Retrieves merged parameters from the request.
* The equivalent of get_param(), but returns all parameters for the request.
* Handles merging all the available values into a single array.
* @return array Map of key to value.
public function get_params() {
$order = $this->get_parameter_order();
$order = array_reverse( $order, true );
foreach ( $order as $type ) {
* array_merge() / the "+" operator will mess up
* numeric keys, so instead do a manual foreach.
foreach ( (array) $this->params[ $type ] as $key => $value ) {
$params[ $key ] = $value;
* Retrieves parameters from the route itself.
* These are parsed from the URL using the regex.
* @return array Parameter map of key to value.
public function get_url_params() {
return $this->params['URL'];