parse_str() Edge Cases

no-email (Damien Seguy), Damien Seguy
Mon, 12 May 2025 00:00:00 +0000

parse_str() reads the variables in the URL's query string, and convert them into an array. When the variable names contain a dot ``.``, that dot is automagically converted to an underscore.
This happens with the ``dot``, but also other characters, such as `` `` (space), ``+`` (which is a space too), and a single opening ``[`` (when completed with a closing one, that variable becomes an array).
This is coming from previous versions of PHP, where these variables ended being converted into PHP variables. And the listed characters are actually forbidden in variable names. This is not a problem anymore, since PHP avoids creating variables that way, for security reasons. Yet, for backward compatibility reasons, these conversions are still in place.