Worse, automatically adding request variables to the global namespace, in an order that if input validation is implemented but naively/buggily there can be easy ways to bypass it.