I have flashbacks of when my PHP teacher showed us how to turn query parameters into their own variables by using PHP's dynamic variables feature.

He waited a bit, and promptly said to never do that and started to explain the security risks.