title: Removing arrays from superglobals ($_GET, $_POST...)
body: <p>In PHP it's possible to have arrays in <code>$_GET</code>, <code>$_POST</code>, <code>$_COOKIE</code>, <code>$_FILES</code> and <code>$_REQUEST</code> according to <a href="http://php.net/manual/en/faq.html.php#faq.html.arrays" rel="nofollow">PHP documentation</a>. The problem is that those come from user and I might get them instead of strings. For example, consider following snippet.</p>
  
  <pre><code>&lt;?php
  if (isset($_GET['hello'])) {
      echo 'Hello, ', htmlspecialchars($_GET['hello']), '.';
  }
  else {
      echo '&lt;form action="?"&gt;&lt;input name="hello"&gt;&lt;input type="submit"&gt;&lt;/form&gt;';
  }
  </code></pre>
  
  <p>Looks OK? Well, as long you will not work will the URL it will work correctly. The problem is that hacker can try making <code>$_GET['hello']</code> an array. If URL string looks like <code>?hello[]=something</code> PHP will return error message</p>
  
  <blockquote>
    <p>Warning: htmlspecialchars() expects parameter 1 to be string, array given in FILE on line 3</p>
  </blockquote>
  
  <p>OK, who would enable in HTML errors in the production site (the other thing is error log...). But integers also are a problem - PHP is dynamically typed language, so it would accept easily code like <code>'2' + 2</code>. While yes, you can use <code>(int)</code> I have some old code which doesn't do that. If string comes from <code>$_GET</code> or <code>$_POST</code> it could be also array. Something like <code>array('2') + 2</code> would cause fatal error of PHP.</p>
  
  <blockquote>
    <p>Fatal error: Unsupported operand types in FILE on line 3</p>
  </blockquote>
  
  <p>Now it's something that isn't acceptable because it would stop the script. I don't need arrays in those variables, but they annoy me. Is there any simple snippet which would remove arrays from those special variables. If I really would want an array, I could make copy of it before running the snippet.</p>