YourOpenSource

$_REQUEST

echo $_GET['id']; // 1
echo $_COOKIE['id']; // 2
echo $_REQUEST['id']; // 2

$_SERVER

Even though the $_SERVER super-global is populated based on data supplied by the webserver it should not be trusted.

• User may inject data via headers Host: <script> ...
• Some parameters contain data based on user input
  REQUEST_URI, PATH_INFO, QUERY_STRING
• Can be fakes
  Spoofed IP address via the use of anonymous proxies