The issue is not limited to PHP. Node.js/V8, CPython, Java, CRuby 1.8 and quite a lot of other implementations have this problem. Furthermore this is a problem

The issue is not limited to PHP. Node.js/V8, CPython, Java, CRuby 1.8 and quite a lot of other implementations have this problem. Furthermore this is a problem you will encounter in every case in which the keys you populate a hash table with come from an untrusted source.