diff --git a/core/modules/user/lib/Drupal/user/AccountFormController.php b/core/modules/user/lib/Drupal/user/AccountFormController.php
index ca8e638..ab1f035 100644
--- a/core/modules/user/lib/Drupal/user/AccountFormController.php
+++ b/core/modules/user/lib/Drupal/user/AccountFormController.php
@@ -68,7 +68,8 @@ public function form(array $form, array &$form_state) {
 
       // To skip the current password field, the user must have logged in via a
       // one-time link and have the token in the URL.
-      $pass_reset = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
+      $request = \Drupal::request()->request->get('pass-reset-token');
+      $pass_reset = isset($_SESSION['pass_reset_' . $account->uid]) && ($request == $_SESSION['pass_reset_' . $account->uid]);
       $protected_values = array();
       $current_pass_description = '';
 
diff --git a/core/modules/user/user.admin.inc b/core/modules/user/user.admin.inc
index 9946ae2..8913ed6 100644
--- a/core/modules/user/user.admin.inc
+++ b/core/modules/user/user.admin.inc
@@ -21,7 +21,8 @@
  *   A renderable form array for the respective request.
  */
 function user_admin($callback_arg = '') {
-  $op = isset($_POST['op']) ? $_POST['op'] : $callback_arg;
+  $request = Drupal::request()->request->get('op');
+  $op = !empty($request) ? $request : $callback_arg;
 
   switch ($op) {
     case t('Create new account'):
@@ -30,7 +31,9 @@ function user_admin($callback_arg = '') {
       $build['user_register'] = entity_get_form($account, 'register');
       break;
     default:
-      if (!empty($_POST['accounts']) && isset($_POST['operation']) && ($_POST['operation'] == 'cancel')) {
+      $accounts = Drupal::request()->request->get('accounts');
+      $operation = Drupal::request()->request->get('operation');
+      if (!empty($accounts) && $operation == 'cancel')  {
         $build['user_multiple_cancel_confirm'] = drupal_get_form('user_multiple_cancel_confirm');
       }
       else {
diff --git a/core/modules/user/user.pages.inc b/core/modules/user/user.pages.inc
index 5f0cfab..1226f1e 100644
--- a/core/modules/user/user.pages.inc
+++ b/core/modules/user/user.pages.inc
@@ -203,9 +203,10 @@ function template_preprocess_user(&$variables) {
  */
 function user_edit_cancel_submit($form, &$form_state) {
   $destination = array();
-  if (isset($_GET['destination'])) {
+  $request = Drupal::request()->query->get('destination');
+  if (!empty($request)) {
     $destination = drupal_get_destination();
-    unset($_GET['destination']);
+    Drupal::request()->query->remove('destination');
   }
   // Note: We redirect from user/uid/edit to user/uid/cancel to make the tabs disappear.
   $account = $form_state['controller']->getEntity();