Besides route parameters, there are three more sources of input data: query parameters, body data, and headers. Symfony's Request object bundles them all uniformly.

Injecting the Request object

A controller parameter of type Request gets AUTOMATICALLY filled with the current request by Symfony – NOT an autowired service, but a special type recognized by Symfony itself:

use Symfony\Component\HttpFoundation\Request;

#[Route('/projects', name: 'project_index', methods: ['GET'])]
public function index(Request $request): Response
{
    // $request is now available
    return new Response('...');
}

Reading query parameters: $request->query

For /projects?status=active&sort=name:

$status = $request->query->get('status'); // 'active'
$sort = $request->query->get('sort', 'created'); // 'name', default: 'created'
$page = $request->query->getInt('page', 1); // typed as int, default 1

getInt(), getBoolean(), and other typed getters avoid manual (int) casts and automatically return the given default when the parameter is missing.

Reading POST form data: $request->request

Confusingly named, but important to know: $request->request (NOT $request itself!) holds classic form data (application/x-www-form-urlencoded or multipart/form-data):

$title = $request->request->get('title');
$description = $request->request->get('description', '');

Reading a JSON body: for later API endpoints

$data = json_decode($request->getContent(), true);
$title = $data['title'] ?? null;

getContent() returns the raw request body as a string – the right approach for JSON requests (as a later API extension of our task manager might use), since $request->request only understands form-encoded data.

Reading headers: $request->headers

$userAgent = $request->headers->get('User-Agent');
$isAjax = $request->headers->get('X-Requested-With') === 'XMLHttpRequest';

File uploads: $request->files

$uploadedFile = $request->files->get('attachment');
if ($uploadedFile !== null) {
    $originalName = $uploadedFile->getClientOriginalName();
}

An UploadedFile object instead of a raw string – offers getClientOriginalName(), getMimeType(), and move() to save it to a target location, all type-safe instead of PHP's classic $_FILES superglobal.

Overview: all request data sources