That example was particularly egregious. PHP uses copy-on-write so the temp variable held a pointer to the 500k of data they mentioned, not a copy. Had they co

That example was particularly egregious. PHP uses copy-on-write so the temp variable held a pointer to the 500k of data they mentioned, not a copy. Had they concatenated a small string to the end then PHP wouldn't copied the data and used the MB of memory they alluded to. That whole document was half baked at best. EDIT: I went to look at the document to reference the example and noticed that they changed their example. It used to be: $description = $_POST['description']; echo $description; And now it's: In the following example, imagine if a malicious user had inserted 512KB worth of characters into a textarea field. This would result in 1MB of memory being used! $description = strip_tags($_POST['description']); echo $description; There's no reason to copy the variable above, you can simply do this operation inline and avoid the extra memory consumption: echo strip_tags($_POST['description']); So someone is definitely working on making the examples at least match the description.