Not to pick on your comment specifically, but I've seen a couple of comments that imply this is the kind of mistake that one would make in a moment of absent-mindedness, and I disagree. Nobody with any semblance of a clue is writing (new) apps that access user input from PHP super globals directly. If you are ever using $_GET in your app-specific code you are doing it horribly wrong, not making a silly mistake.

That being said, there are legions of clueless devs out there who will do this, and that is unfortunate.

I agree with the clueless argument, but I also think there are mountains of bugs that exist simply because one made a mistake and a dynamically typed languages can't really do much for them there.