note 118922 deleted from function.parse-str by sobak

Note Submitter: aaronw at catalyst dot net dot nz ---- DO NOT make a practice of using the one-parameter version of this function, particularly for processing user input. It's susceptible to exactly the same sorts of bugs and security problems as the old "register_globals" setting. I'm actually rather surprised there's not a warning message about it on this page. If you use the one-parameter version of parse_str() in global scope (i.e. outside of any functions), it lets the user override ANY global variables in your script, even superglobals like $_GET and $_REQUEST. If you use it inside a function, it can't touch your global variables but it can still override any variables already defined in the function, or populate variables that later get accessed without prior initialization. You can guard against these problems by making sure to call parse_str() only in function/method scope, and before any variable declarations, and making sure to initialize all variables before accessing them. But why leave yourself open? Just use the two-parameter version of parse_str(). // BAD parse_str($_SERVER['QUERY_STRING']); echo $foo; // BETTER parse_str($_SERVER['QUERY_STRING'], $urlparams); echo $urlparams['foo'];