Forbid write access to entire $GLOBALS

[weirdan]

https://wiki.php.net/rfc/restrict_globals_usage

Psalm should warn whenever $GLOBALS as a whole could be modified.

[orklah]

besides $_SESSION, is there another superglobal where it's legit to write on?

I'd be all for forbidding rewriting values in any superglobal (except for sessions of course)

[weirdan]

Pretty much all individual elements of superglobal arrays can be written to. E.g. $_GET['a'] = "b", $_SERVER["whatever"] = "flies" etc - basically monkey-patching them to work around code that uses superglobals. Replacing entire superglobal is also occasionally useful - e.g. unset($_GET) to force people to use PSR request instead. None of these changed in 8.1.

An option to flag superglobal access (both read and write) would be useful, but this issue is not about that.