Possible Variable Overwrite: Global Scope

The program invokes a function that can overwrite global variables, which can open the door for attackers.

Functions that can overwrite global variables that are already initialized can allow an attacker to influence the execution of code that relies on the overwritten variables.
Example 1: If an attacker supplies a malicious value for str in the following segment of PHP code, then the call to mb_parse_str() might overwrite any arbitrary variables, including first. In this case, if a malicious value that contains JavaScript overwrites first, then the program is vulnerable to cross-site scripting.

<?php
    $first="User";
    ...
    $str =  $_SERVER['QUERY_STRING'];
    mb_parse_str($str);
    echo $first;
?>