<?php
// Don't do this !
$value = urldecode($_GET['something']);
?>

<?php
$query = htmlspecialchars($_GET['query']);  
$query = str_replace('%2522', '', $query);  
$query = str_replace('%27', '', $query);  
$query = str_replace('%2527', '', $query);  
?>

<?php
// good 
str_replace('&amp;', '&', htmlspecialchars($_GET['redirect']);
// bad
htmlspecialchars(urldecode($_GET['redirect']));
?>

<?php
session_start();
$_SESSION['test'] = "original";
$test = "modified";
echo $_SESSION['test'];
 
// this will output "modified" instead of "original"
?> 

<?php
$_SESSION['test'] = $something;
echo $_SESSION['test'];
 
// Point to the file in browser, with query append to the back:
// test.php?something=modified
// The string "modified" will be output
?>