params() overwrites $_REQUEST params with slug names about klein.php HOT 2 CLOSED

This is expected behavior. Klein's an intelligent router that allows you to have "named" parameters in the URL. If you're proposed behavior were the default, someone would be able to overwrite the URL-matched parameter, which would be "sketchy" and unexpected.

The design is that the named params take precedence. If you're finding that you have a collision, simply rename your url-matched param, or rename your expected GET/POST param. :)

from klein.php.

$_REQUEST already works in this way in regards to whether variables are taken from $_GET, $_POST or $_COOKIE - see the variables_order config directive.

If parameters from the query string or request body were allowed to override named parameters then type restrictions could be bypassed, e.g. a /users/[i:id] route vs. /users/0?id=0%3B%20DROP%20TABLE%20users 😲

Klein could be modified so that it doesn't mutate the underlying $_REQUEST array but I think as an extra security precaution it's ok for now.

from klein.php.