note 83546 added to reserved.variables

SETUP: Using PHP 5.2.5 and have magic_quotes_gpc set to "Off" in php.ini (in fact, all the magic_quotes options are set to Off). It appears that _GET / _POST / _COOKIE are all pre-urldecoding their data. When I call urldecode on any of the variables retrieved from one of these superglobals, it comes back as though it were *double* urldecoded (which could be dangerous). In my example, I had urlencoded a cookie with the string "%40" in it. I urlencoded that string before caling setrawcookie(). When I got the string back from $_COOKIE on a subsequent request, it already was decoded to show %40. I have yet to find any specific documentation about whether or not _GET/_POST/_COOKIE are auto-urldecoded, but from experience they appear to be (regardless of php.ini settings). ---- Server IP: 64.71.164.2 Probable Submitter: 66.151.128.22 ---- Manual Page -- http://www.php.net/manual/en/reserved.variables.php Edit -- https://master.php.net/note/edit/83546 Del: integrated -- https://master.php.net/note/delete/83546/integrated Del: useless -- https://master.php.net/note/delete/83546/useless Del: bad code -- https://master.php.net/note/delete/83546/bad+code Del: spam -- https://master.php.net/note/delete/83546/spam Del: non-english -- https://master.php.net/note/delete/83546/non-english Del: in docs -- https://master.php.net/note/delete/83546/in+docs Del: other reasons-- https://master.php.net/note/delete/83546 Reject -- https://master.php.net/note/reject/83546 Search -- https://master.php.net/manage/user-notes.php