I thought the evil had been buried with PHP3.
I was wrong.
I was put to the task of fixing a Russian form-handler. It was like traveling back in time. The includes included includes (which included includes…), nothing was type cast, and all form data was haphazardly called by superglobals.
Jesus.
A five year old girl could hack this shit with a cellphone.
Luckily the security issues were outside the scope of my obligations. Haha.