Security array_diff(array, string) does(n't) work as expected This is an old problem, quite a few security researchers already wrote about. But repeating things, helps learning them (especially me). In MageSetup we read posted agreements (terms and conditions) and compare them