> (If you can tell me about csrf and have set up csrf protection in a project you're in the minority of php developers)

Incidentally, I wrote this: https://github.com/resonantcore/lib/blob/master/src/Security...

#3 is surprising to me. I've seen some strange behavior (throwing [0] after a post field can lead to unexpected errors and sometimes lead to an information leak) but never RCE.