except when in PHP you occasionally have a feature that itself is a security hole by definition, aka. register_globals