Directly modifying superglobals
<p>I've seen people (who generally write good code) directly alter the <code>$_POST</code> array with code like this:</p>

<pre><code>// Add some value that wasn't actually posted
$_POST['last_activity'] = time();

// Alter an existing post value
$_POST['name'] = trim($_POST['name']);

// Our pretend function
// Pass the entire $_POST array as data to work with in the function
// The function update_record() will read only the values we actually need
update_record($_POST);

// ...That sure was easier than creating a new array 
//  with only the $_POST values we actually need.
</code></pre>

<p>It makes sense that <code>update_record()</code> should not access $_POST directly, so we can pass other arrays of data to it for instance, but surely this is lazy, bad design, or possibly just wrong? However, we are still passing a valid array to <code>update_record()</code>, so why create a new one?</p>

<p>This is not the point of the question, just an example of usage. However, I have heard plenty of people say that this should not be done with <code>$_REQUEST</code> data, and it's bad practice. But why? Looks harmless enough.</p>

<p>Examples:</p>

<ul>
<li><p>Setting a default <code>$_GET</code> (or post) value that doesn't really exist</p></li>
<li><p>Adding <code>$_POST</code> values that weren't actually posted after a form submission</p></li>
<li><p>Directly sanitizing or filtering the <code>$_GET</code> array values <em>or keys</em> very early in the script (fallback sanitation... why not?)</p></li>
<li><p>Setting a <code>$_POST</code> value manually before form submission to populate an input with a default value (when the input reads <code>$_POST</code> for it's default value; I have done this)</p></li>
<li><p>Making up your own <code>$_SERVER</code> values? Sure, hey why not?</p></li>
<li><p>How about the others, like <code>$_COOKIE</code> and <code>$_SESSION</code>? Of course we have to modify those directly right? Then why not the others?</p></li>
</ul>

<p>Should direct modification of <a href="http://www.php.net/manual/en/language.variables.superglobals.php">superglobals</a> <strong><em>never</em></strong> be done, or is it OK to do in <strong><em>some</em></strong> instances?</p>
