note 95672 added to reserved.variables.server

I was testing with the $_SERVER variable and some request method, and I found that with apache I can put an arbitrary method. For example, I have an script called "server.php" in my example webpage with the next code: <?php echo $_SERVER['REQUEST_METHOD']; ?> And I made this request: c:\>nc -vv www.example.com 80 example.com [x.x.x.x] 80 (http) open ArbitratyMethod /server.php HTTP/1.1 Host: wow.sinfocol.org Connection: Close The response of the server is the next: HTTP/1.1 200 OK Date: Fri, 15 Jan 2010 05:14:09 GMT Server: Apache Connection: close Transfer-Encoding: chunked Content-Type: text/html ArbitratyMethod So, be carefully when include the $_SERVER['REQUEST_METHOD'] in any script, this kind of "bug" is old and could be dangerous. ---- Server IP: 69.147.83.197 Probable Submitter: 190.71.48.21 (proxied: 200.110.100.195) ---- Manual Page -- http://www.php.net/manual/en/reserved.variables.server.php Edit -- https://master.php.net/note/edit/95672 Del: integrated -- https://master.php.net/note/delete/95672/integrated Del: useless -- https://master.php.net/note/delete/95672/useless Del: bad code -- https://master.php.net/note/delete/95672/bad+code Del: spam -- https://master.php.net/note/delete/95672/spam Del: non-english -- https://master.php.net/note/delete/95672/non-english Del: in docs -- https://master.php.net/note/delete/95672/in+docs Del: other reasons-- https://master.php.net/note/delete/95672 Reject -- https://master.php.net/note/reject/95672 Search -- https://master.php.net/manage/user-notes.php