8 years and you didn't know this? I assume it's the part where it turns [] passed vars into arrays. Even still, this is only a problem is you are blindly passing around user input without any verification. The same thing is just as easily accomplished in numerous other languages.

Honestly, I'm trying to figure out how someone could sanitize their input and still be affected by this.