note 83546 deleted from reserved.variables by googleguy

Note Submitter: SilentChris at gmail dot com ---- SETUP: Using PHP 5.2.5 and have magic_quotes_gpc set to "Off" in php.ini (in fact, all the magic_quotes options are set to Off). It appears that _GET / _POST / _COOKIE are all pre-urldecoding their data. When I call urldecode on any of the variables retrieved from one of these superglobals, it comes back as though it were *double* urldecoded (which could be dangerous). In my example, I had urlencoded a cookie with the string "%40" in it. I urlencoded that string before caling setrawcookie(). When I got the string back from $_COOKIE on a subsequent request, it already was decoded to show %40. I have yet to find any specific documentation about whether or not _GET/_POST/_COOKIE are auto-urldecoded, but from experience they appear to be (regardless of php.ini settings).