PHP has done pretty big breaking changes in the past, the thing that immediately comes to mind is register_globals (there are probably others, but my PHP experi

PHP has done pretty big breaking changes in the past, the thing that immediately comes to mind is register_globals (there are probably others, but my PHP experience is mainly from a decade ago). Originally GET/POST, cookie and environment values automatically became variables. This means page.php?id=123 gave you a variable $id. Along with no variable declarations, this was intuitive and was probably one of the reasons PHP was so popular with beginner developers. Unfortunately it was also the cause of untold numbers of security bugs, because people would write code like: if (securityCheck()) { $isAdmin = true; } //.... if ($isAdmin) {... } Someone making the request page.php?isAdmin=true would totally bypass the intended check. So in April 2002, PHP 4.2 [1] was released that disabled this by default -- but so many (badly written) applications relied on this that it was not until March 2012 -- 10 years later! -- that PHP 5.4 [2] finally removed this option entirely. [1] https://www.php.net/releases/4_2_0.php https://www.php.net/releases/4_2_0.php [2] https://www.php.net/releases/5_4_0.php https://www.php.net/releases/5_4_0.php