From a63892142942d45260c45c1bb81eb1433c93a0b7 Mon Sep 17 00:00:00 2001
From: jim winstead <jimw@php.net>
Date: Tue, 23 Jan 2001 02:35:42 +0000
Subject: [PATCH] document that HTTP_*_VARS are always set when enabled

git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@40023 c90b9560-bf6c-de11-be94-00142212c4b1
---
 language/variables.xml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/language/variables.xml b/language/variables.xml
index 79b8a83804..4f198903d1 100644
--- a/language/variables.xml
+++ b/language/variables.xml
@@ -432,7 +432,9 @@ $bar = &amp;test();    // Invalid.
      These variables are created by PHP itself. The
      <varname>$HTTP_*_VARS</varname> variables are available only if
      the <link linkend="ini.track-vars">track_vars</link>
-     configuration is turned on.
+     configuration is turned on. When enabled, the variables are
+     always set, even if they are empty arrays. This prevents
+     a malicious user from spoofing these variables.
     </simpara>
 
     <note>