PHP Security: Trouble With Input Source (GET, POST, ENV, Cookie, SERVER)

At small application, possible still modestly in managing variable. But when the application become bigger, variable naming become the muddle. Will very wise if we take a care to determine the source for variable

<?
echo $test;
?>

It can come from $_GET['test'], $_POST['test'], $_SESSION['test'], etc. Depend of your php.ini. Try to open your php.ini (my php.ini within C:\WINDOWS. It depend installation). Find like following line code:

variables_order = "EGPCS"

It mean high priority is from ENV. Then GET, POST, Cookie, last SERVER. So, if you write like this:

<?
echo $test;
?>

It will find from $_ENV['test'] for first time. You can change your php.ini and set as you need, like:

variables_order = "GPSC"