Nice find, although it's not really clear to me whether this is intended functionality or not. I assume it's not intended by Hardened-PHP and Suhosin, at least :) You didn't mention this, but even if register_globals is disabled, this seems to work, at least in my PHP 4.4.4. Try the code below with: ?var=new --> generates an error (display_errors=1) that var2 is undefined ?var2=new --> prints "var2 = new" <?php $var = 'init'; # parse_str($_SERVER['QUERY_STRING']); # print "var = $var<p>\n"; # new print "var2 = $var2<p>\n"; # new ?> - Steve
