When a script starts, the initial values for global variables come from one of several sources, in order of precedence:

1. URL state
   <EXPORT> variables from the URL.

2. State table
   <EXPORT> variables from the state table.

3. Command line
   Variables initialized on the command line.

4. Environment
   Environment variables, such as REMOTE_ADDR .

5. HTTP cookies
   The value of any HTTP cookies sent by the Web browser.

6. Query string
   Ordinary URL variables given in the query string of the URL (ie. via the GET method on a form, or <EXPORT nbsp;QUERY> variables).

7. POST content
   Query-string style variables given in the content (ie. the POST method on a form). These could also be multipart MIME variables from a form upload (see the section on Multi-part nbsp;File nbsp;Uploads ).

These sources are checked in order, from first to last: the first source that has values for a given variable will be used. Only values from this first (highest precedence) source will be used to initialize the global variable. If none of these sources has a value for the variable, it has no initial values.

Because of this ordering, lower-precedence values cannot override higher ones when more than one source has values for the same variable. For example, a sensitive environment variable like $REMOTE_ADDR will not be overridden by a query-string variable of the same name. This helps prevent (un)intentional manipulation of a script's variables by the Web client: more "trusted" sources are used before less "trusted" ones.

(This precedence ordering can be altered in <EXPORT> variables by using the USEROK flag; see the manual on <EXPORT> .)