Array in HTTP GET/POST requests

Question

In PHP server programming, URL-encoded GET/POST requests are parsed into associative "array" type upon receiving. For most of the time, query arguments can be assumed to be strings, however sometimes certain query arguments are parsed into nested arrays.

For example:

query.php?a=123&b[]=456&b[]=789

is parsed as

[ 'a'=>"123", 'b'=>["456","789"] ]

As many functions in PHP are fault-tolerant in extremely unexpected ways, I'd like to ask the expertise of this site: is it generally acceptable to outright reject non-string queries, avoiding them as much as possible, and use query parameter prefixes instead?

Also, what are the some recommended programming practices in this regard?

---

Reason for asking

Recently, I saw a youtube video, where someone used a home-grown crypto scheme to verify client-controlled shell command. It used a nonce in POST argument to hmac with the command string. When the nonce is array, the hmac function verbosely succeeds and security is bypassed. It originates from a twitter image that says roughly says "this PHP code contains a deadly bug".

Update

In essence, I've wanted to ask, what are the general 'sane' patterns of query string. Since this would be too broad and mostly opinion based, it should only be included as side notes in answers.

Answer 1

You are the author of the website or otherwise server-side code — you get to decide what is a valid query string or not. Why would you concern yourself about what is acceptable? Your first responsibility is to design your API to behave as expected and be secure, not to offer « courtesy » in accepting any kind of input. Regular users are on the contrary keen to know how you defined the API, and adversaries are keen to know what you are missing.

It is perfectly acceptable, and even it is a strong requirement to validate user input, always. The video explains a problem with a bug, in that the author of the snippet did not defend against an unexpected behaviour of PHP. A string was expected and an array was passed, input was not validated, problem occurs.

Best practices always include that if you are taking input from external sources, you must validate, sanitise or otherwise verify it before doing anything with it, according to the rules you have set for your API.

P.S.: for those interested, this is the video referred to by OP: video