Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a...
by meritt on Monday July 08, 2019 @10:18PM
(#20388487)
Correct, this behavior is well-known and has been around for 20+ years. Leading spaces are removed and additionally other spaces or dots are converted to an underscore.
For this reason, many frameworks ignore the default $_GET structure and instead access the raw URI query in $_SERVER['QUERY_STRING'].
For this reason, many frameworks ignore the default $_GET structure and instead access the raw URI query in $_SERVER['QUERY_STRING'].