According to the OWASP PHP cheat sheet:
$_REQUESTis strongly discouraged. This super global is not recommended since it includes not only POST and GET data, but also the cookies sent by the request. All of this data is combined into one array, making it almost impossible to determine the source of the data. This can lead to confusion and makes your code prone to mistakes, which could lead to security problems.
I understand why this is bad practice from a programming perspective, but I do not understand the security implications of this. Since the attacker - the person sending the request - has full control over all three - get variables, post variables and cookies - I don't see what difference it makes.
One issue I could see is if e.g. a WAF checks the query string for suspicious behaviour, so the attacker instead delivers the payload in a cookie. But is there any other issues? Can anyone give me a concrete example of how the usage of
$_REQUEST would cause a vulnerability?