note 16860 added to function.parse-str

"parse_str doesn't escape input securely" - I found that not to be true. It is not parse_str the one who is messing up - it's probably your test code. I think what you tried looks something like this: $secret="Secret"; parse_str("test=$secret"); echo("test=$test"); You are going to get "test=Secret". But that's because the string you are sending to parse_str is actually "test=Secret". Try this instead: $secret="Secret"; parse_str("test=\$secret"); echo("test=$test"); In this case, when actually being sent "test=$secret", it will print exactly that ("test=$secret"). Actually, the correct urlencoded string to pass to parse_str would be "test=%24secret"... -- http://www.php.net/manual/en/function.parse-str.php http://master.php.net/manage/user-notes.php?action=edit+16860 http://master.php.net/manage/user-notes.php?action=delete+16860 http://master.php.net/manage/user-notes.php?action=reject+16860