Define a variable before using it. This is the only way to make sure.
Many web hosts still have register_globals . This allows any visitor to enter variables into your script, adding material to the query string.
For example, if your script is called as example.php?the_month=5 , the variable $the_month automatically populated with 5. This can be very dangerous because someone might encounter important security related variables! For this reason, register_globals now deprecated.
But this does not change the fact that many web hosts are still enabled, so every PHP developer must define each variable before something is safe before using it. Otherwise, you have no guarantee that the variable will contain what you think.
source share