In PHP server programming, URL-encoded GET/POST requests are parsed into associative "array" type upon receiving. For most of the time, query arguments can be assumed to be strings, however sometimes certain query arguments are parsed into nested arrays.
is parsed as
[ 'a'=>"123", 'b'=>["456","789"] ]
As many functions in PHP are fault-tolerant in extremely unexpected ways, I'd like to ask the expertise of this site: is it generally acceptable to outright reject non-string queries, avoiding them as much as possible, and use query parameter prefixes instead?
Also, what are the some recommended programming practices in this regard?
Reason for asking
Recently, I saw a youtube video, where someone used a home-grown crypto scheme to verify client-controlled shell command. It used a nonce in POST argument to hmac with the command string. When the nonce is array, the hmac function verbosely succeeds and security is bypassed. It originates from a twitter image that says roughly says "this PHP code contains a deadly bug".
In essence, I've wanted to ask, what are the general 'sane' patterns of query string. Since this would be too broad and mostly opinion based, it should only be included as side notes in answers.