Header & Globals

HEADER sets HTTP response headers. Global runtime data — request input, server variables, environment, session, cookies, and time — is accessed with the ! prefix accessor syntax.

HEADER

HEADER sets an HTTP response header using a name and value separated by AS. Multiple headers can be set in a single statement using AND. Headers must be set before any output is emitted.

Common Headers
HEADER 'Content-Type' AS 'text/html'
AFTER HEADER 'Content-Type' AS 'application/json'
AFTER HEADER 'Cache-Control' AS 'no-cache'
AFTER HEADER 'X-Custom' AS 'value'
Security Headers
HEADER 'X-Frame-Options' AS 'DENY'
AFTER HEADER 'X-XSS-Protection' AS '1; mode=block'
Multiple Headers in One Statement
HEADER 'X-Custom: value' AND HEADER 'X-Other: other' AND HEADER 'Content-Type: text/plain'

Global Accessors — ! Prefix

Global runtime data is accessed using the ! prefix. Globals are read-only accessors — they reflect the current request context. They can be used anywhere a variable or value is expected.

!POST — Form Data

Accesses values submitted via HTTP POST.

!POST
EMIT !POST('name')
AFTER EMIT !POST('email')

!GET — Query String

Accesses values from the URL query string.

!GET
EMIT !GET('search')
AFTER EMIT !GET('page')

!REQUEST — Merged Input

!REQUEST merges POST and GET, with POST taking priority on collision. It also exposes request metadata via sub-keys.

!REQUEST
EMIT !REQUEST('field')
AFTER EMIT !REQUEST('path')
AFTER EMIT !REQUEST('method')
AFTER EMIT !REQUEST('file:image')

!FILES — Uploaded Files

Returns the web-accessible URL of an uploaded file by its field name.

!FILES
EMIT !FILES('avatar')

!SERVER — Server Variables

Accesses server and execution environment information.

!SERVER
EMIT !SERVER('HTTP_HOST')
AFTER EMIT !SERVER('REQUEST_METHOD')
AFTER EMIT !SERVER('REMOTE_ADDR')

!COOKIE and !SESSION

!COOKIE reads a browser cookie by name. !SESSION reads a session value by key. See Session & Cookies for full session management.

!COOKIE and !SESSION
EMIT !COOKIE('session')
AFTER EMIT !SESSION('user_id')

!ENV — Environment Variables

Reads a system environment variable by name.

!ENV
EMIT !ENV('PATH')

!GLOBALS — Full Context Access

!GLOBALS provides access to the entire request context by category. Useful when you need to traverse or pass the full input set.

!GLOBALS
EMIT !GLOBALS('POST')('name')
AFTER EMIT !GLOBALS('SERVER')('HTTP_HOST')

!GLOBAL — Writable Execution-Wide Store

!GLOBAL is a writable key-value store, scoped to the current script execution — not the request context. Unlike every other accessor on this page, it is not a snapshot of incoming data; it is a place to put your own values so they are visible everywhere in the execution, including across the frame boundary of a NEW OPERATION call, where an ordinary ?var would not reach. See Operations & Return for why this matters.

!GLOBAL — Write and Read
SET !GLOBAL('shared') AS "hello"
AFTER EMIT !GLOBAL('shared')

(* Typed verb target form *)
AFTER STRING "updated" SET !GLOBAL('shared')
AFTER EMIT !GLOBAL('shared')

(* OF chain form *)
AFTER SET "shared" AS "again" OF !GLOBAL
AFTER EMIT "shared" OF !GLOBAL
!GLOBAL is not !GLOBALS. !GLOBAL('key') (singular) is your own writable store for the current execution. !GLOBALS('CATEGORY')('key') (plural) is the read-only request-context accessor documented above. They are unrelated despite the similar name.

!NOW — Current Datetime

!NOW returns components of the current server datetime. It is evaluated at the moment the statement executes.

!NOW
EMIT !NOW('date')
AFTER EMIT !NOW('time')
AFTER EMIT !NOW('timestamp')
AFTER EMIT !NOW('year')
AFTER EMIT !NOW('month')
AFTER EMIT !NOW('day')

!QUERY — The Script Being Executed

!QUERY holds the OcaltQL script currently running — the exact source text the runtime was handed, as submitted. It is read-only, and it is the same for every statement in the execution, since the script does not change while it runs.

!QUERY
EMIT "Hello World"
AFTER EMIT !QUERY
(* Emits Hello World, then the whole two-statement script as text *)
Inspecting the Script From Inside It
LENGTH !QUERY SET ?size
AFTER EMIT "this script is " & ?size & " characters"
AFTER IF !QUERY CONTAINS "DIRECTIVE"
OPEN
  EMIT " and it drives a remote machine"
CLOSE
!QUERY is the script as submitted, not as parsed — comments, whitespace and original casing are all intact. Inside an INCLUDE or SIDELOAD it still reports the outer script that was sent to the runtime, since that is what is executing.

!THAT — The Last Returned Value

!THAT always holds the result of the most recently completed statement, whether or not that statement used SET. Unlike every other global on this page, it is not a passive snapshot of the incoming request — it updates automatically after every single statement, chained or not.

!THAT
ADD 3 TO 5
AFTER MULTIPLY !THAT BY 6
AFTER EMIT !THAT
(* 3 + 5 = 8, then 8 * 6 = 48, then EMIT reads !THAT = 48 *)
Most globals are read-only. !POST, !GET, !REQUEST, !FILES, !SERVER, !COOKIE, !ENV, !GLOBALS, and !NOW reflect the incoming request and runtime environment and cannot be assigned to — use SET ?var to capture a value into a writable variable if you need to mutate it. !SESSION and !GLOBAL are real exceptions — both support genuine write forms, documented on Session & Cookies and above. !THAT is also not a passive snapshot — it updates automatically after every statement, as shown above.

Absent keys vs explicit null: Reading a global key that was never set (e.g. !POST('missing')) returns empty — it prints nothing, IS SET is false, and IS EMPTY is true. An explicit NULL value prints null and is distinct: IS NULL is true. The two are different and the distinction matters for conditional logic.

A real boundary. !POST, !GET, and !REQUEST only return real data inside Site Mode, since that is the only path that forwards a genuine visitor’s request into the executing script. The standard credentialed API (identity/password + q=) carries no GET, POST, or request data at all — these globals return empty inside a script run that way.

Session & Cookies →