Bug #69982 [Opn]: PHP 5.6 populates $_POST with "invalid" data

Edit report at https://bugs.php.net/bug.php?id=69982&edit=1 ID: 69982 Updated by: requinix@php.net Reported by: barry at yourang dot org Summary: PHP 5.6 populates $_POST with "invalid" data Status: Open Type: Bug Package: Unknown/Other Function Operating System: Linux PHP Version: 5.6.10 Block user comment: N Private report: N New Comment: It changed during the implementation of slim_post_data for 5.6.0, but is this really the wrong behavior? It's the same way $_GET works... Looks deliberate: http://git.php.net/?p=php-src.git;a=commitdiff;h=e6084da4735c945cb071c4d9259ea0d702eb77c6;hp=52ff129607a7193cccbc6bdfbf1c1e8586e8d0d2#patch15 (add_post_var explicitly allows "foo&" syntax while old php_std_post_handler code does not) Previous Comments: ------------------------------------------------------------------------ [2015-07-02 20:11:17] barry at yourang dot org Description: ------------ Prior to PHP 5.6, POSTing "invalid" urlencoded data would result in $_POST being an empty array. In PHP 5.6, PHP now populates $_POST, which is unexpected. This change seems backwards incompatible with previous versions of PHP and nothing is mentioned in the documentation that I can find. Test script: --------------- Both of these URLs just do: <?php var_dump($_POST); PHP 5.5.24 $ curl http://viper-7.com/hOubxq/5.5.24/ --data 'key' array(0) { } PHP 5.6.10 $ curl http://viper-7.com/h0PMyx/5.6.10/ --data 'key' array(1) { ["key"]=> string(0) "" } Expected result: ---------------- I would expect the POST request to result in an empty $_POST array in 5.6 just like 5.5 Actual result: -------------- $_POST is populated with data. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69982&edit=1