Possible Variable Overwrite: Functional Scope

The program invokes a function that can overwrite variables in the current scope, which can open the door for attackers.

Functions that can overwrite variables that are already initialized in the current scope can allow an attacker to influence the execution of code that relies on the overwritten variables.
Example 1: If an attacker supplies a malicious value for str in the following segment of PHP code, then the call to parse_str() might overwrite any arbitrary variables in the current scope, including first. In this case, if a malicious value that contains JavaScript overwrites first, then the program is vulnerable to cross-site scripting.

<?php
    $first="User";
    ...
    $str =  $_SERVER['QUERY_STRING'];
    parse_str($str);
    echo $first;
?>