note 16860 deleted from function.parse-str by jimw

"parse_str doesn't escape input securely" - I found that not to be true. It is not parse_str the one who is messing up - it's probably your test code. I think what you tried looks something like this: $secret="Secret"; parse_str("test=$secret"); echo("test=$test"); You are going to get "test=Secret". But that's because the string you are sending to parse_str is actually "test=Secret". Try this instead: $secret="Secret"; parse_str("test=\$secret"); echo("test=$test"); In this case, when actually being sent "test=$secret", it will print exactly that ("test=$secret"). Actually, the correct urlencoded string to pass to parse_str would be "test=%24secret"...