Nice find, although it's not really clear to me whether this is
intended functionality or not. I assume it's not intended by
Hardened-PHP and Suhosin, at least

You didn't mention this, but even if register_globals is disabled,
this seems to work, at least in my PHP 4.4.4.

Try the code below with:

?var=new

--> generates an error (display_errors=1) that var2 is undefined

?var2=new

--> prints "var2 = new"



<?php
$var = 'init'; #
parse_str($_SERVER['QUERY_STRING']); #
print "var = $var<p>\n"; # new

print "var2 = $var2<p>\n"; # new

?>


- Steve