Earlier quoted context omitted.
Side side note. This same carelessness is what caused the heart bleed bug.
Well, in a sense maybe, but not on purpose there. The programmer had missed a bounds check.
I think you're giving him too much credit. The input was not sanitized. Now its no one programmers fault. It was a long living bug many had a chance to see it and correct it for a long time. It was rooted in the same carelessness as exec(GET)