I've seen people (who generally write good code) directly alter the
$_POST array with code like this:
// Add some value that wasn't actually posted $_POST['last_activity'] = time(); // Alter an existing post value $_POST['name'] = trim($_POST['name']); // Our pretend function // Pass the entire $_POST array as data to work with in the function // The function update_record() will read only the values we actually need update_record($_POST); // ...That sure was easier than creating a new array // with only the $_POST values we actually need.
It makes sense that
update_record() should not access $_POST directly, so we can pass other arrays of data to it for instance, but surely this is lazy, bad design, or possibly just wrong? However, we are still passing a valid array to
update_record(), so why create a new one?
This is not the point of the question, just an example of usage. However, I have heard plenty of people say that this should not be done with
$_REQUEST data, and it's bad practice. But why? Looks harmless enough.
Setting a default
$_GET(or post) value that doesn't really exist
$_POSTvalues that weren't actually posted after a form submission
Directly sanitizing or filtering the
$_GETarray values or keys very early in the script (fallback sanitation... why not?)
$_POSTvalue manually before form submission to populate an input with a default value (when the input reads
$_POSTfor it's default value; I have done this)
Making up your own
$_SERVERvalues? Sure, hey why not?
How about the others, like
$_SESSION? Of course we have to modify those directly right? Then why not the others?
Should direct modification of superglobals never be done, or is it OK to do in some instances?