6 years ago

Category: PHP

In this post, we'll see how the PHP query string parser could lead to many IDS/IPS and Application Firewall rules bypass. TL;DR: As you know, PHP converts query string (in the URL or body) to an associative array inside $_GET or $_POST. For example: /?foo=bar becomes Array([foo] => "bar").