fix: match PHP $_REQUEST merge semantics in getRequestData()

Use array_replace_recursive() instead of array_merge() so numeric keys
are preserved and array values are merged recursively, matching PHP's
php_autoglobal_merge. Add tests for both behaviors, update the getVar()
user guide docs, and add a changelog entry.

Author: rahul05ranjan

system/Superglobals.php

@@ -417,9 +417,12 @@ public function getRequestData(?string $requestOrder = null): array
 
         foreach (str_split($requestOrder) as $type) {
             match ($type) {
-                'G'     => $request = array_merge($request, $this->get),
-                'P'     => $request = array_merge($request, $this->post),
-                'C'     => $request = array_merge($request, $this->cookie),
+                // array_replace_recursive() matches PHP's own $_REQUEST merge
+                // (php_autoglobal_merge): numeric keys are preserved and
+                // array values are merged recursively.
+                'G'     => $request = array_replace_recursive($request, $this->get),
+                'P'     => $request = array_replace_recursive($request, $this->post),
+                'C'     => $request = array_replace_recursive($request, $this->cookie),
                 default => null,
             };
         }

tests/system/SuperglobalsTest.php

@@ -359,6 +359,25 @@ public function testGetRequestDataIgnoresUnknownOrderTypes(): void
         $this->assertSame(['get_key' => 'get_value'], $data);
     }
 
+    public function testGetRequestDataPreservesNumericKeys(): void
+    {
+        $this->superglobals->setGetArray([100 => 'foo']); // @phpstan-ignore argument.type (numeric keys are valid in superglobals, e.g. ?100=foo)
+
+        $data = $this->superglobals->getRequestData('G');
+
+        $this->assertSame([100 => 'foo'], $data);
+    }
+
+    public function testGetRequestDataMergesRecursively(): void
+    {
+        $this->superglobals->setGetArray(['a' => ['x' => 'get']]);
+        $this->superglobals->setPostArray(['a' => ['y' => 'post']]);
+
+        $data = $this->superglobals->getRequestData('GP');
+
+        $this->assertSame(['a' => ['x' => 'get', 'y' => 'post']], $data);
+    }
+
     // $_FILES tests
     public function testFilesGetArray(): void
     {

user_guide_src/source/changelogs/v4.7.5.rst

@@ -61,6 +61,7 @@ Bugs Fixed
 - **I18n:** Fixed a bug where ``Time::today()``, ``Time::yesterday()``, and ``Time::tomorrow()`` ignored the specified ``$timezone`` and ``setTestNow()`` when calculating the day.
 - **Logger:** Fixed a bug where interpolating a log message with array or non-stringable context values could raise PHP warnings or errors.
 - **Validation:** Fixed a bug where ``valid_cc_number`` accepted non-digit characters (e.g., a decimal point) in the card number. Such values could pass the Luhn check and triggered an ``Undefined array key`` warning inside it; the number is now checked with ``ctype_digit()``.
+- **IncomingRequest:** Fixed a bug where ``getVar()`` returned stale data after ``$_GET`` was updated during URI parsing. It now returns a merged view of ``$_GET``, ``$_POST``, and ``$_COOKIE`` (respecting the ``request_order`` ini setting) instead of reading the stale ``$_REQUEST``.
 
 See the repo's
 `CHANGELOG.md <https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md>`_

user_guide_src/source/incoming/incomingrequest.rst

@@ -162,7 +162,7 @@ getVar()
     in new projects. Even if you are already using it, we recommend that you use
     another, more appropriate method.
 
-The ``getVar()`` method will pull from ``$_REQUEST``, so will return any data from ``$_GET``, ``$_POST``, or ``$_COOKIE`` (depending on php.ini `request-order <https://www.php.net/manual/en/ini.core.php#ini.request-order>`_).
+The ``getVar()`` method returns a merged view of ``$_GET``, ``$_POST``, and ``$_COOKIE`` (depending on php.ini `request-order <https://www.php.net/manual/en/ini.core.php#ini.request-order>`_). It does not read or modify ``$_REQUEST``.
 
 .. warning:: If you want to validate POST data only, don't use ``getVar()``.
     Newer values override older values. POST values may be overridden by the
@@ -373,14 +373,16 @@ The methods provided by the parent classes that are available are:
                         `Types of filters <https://www.php.net/manual/en/filters.php>`__.
         :param  int     $flags: Flags to apply. A list of flags can be found in
                         `Filter flags <https://www.php.net/manual/en/filter.constants.php#filter.constants.flags.generic>`__.
-        :returns:   ``$_REQUEST`` if no parameters supplied, otherwise the REQUEST value if found, or null if not
+        :returns:   The merged ``$_GET``, ``$_POST``, and ``$_COOKIE`` data if no parameters supplied, otherwise the value if found, or null if not
         :rtype: array|bool|float|int|object|string|null
 
         .. important:: This method exists only for backward compatibility. Do not use it
             in new projects. Even if you are already using it, we recommend that you use
             another, more appropriate method.
 
-        This method is identical to ``getGet()``, only it fetches REQUEST data.
+        This method is identical to ``getGet()``, only it fetches the merged
+        ``$_GET``, ``$_POST``, and ``$_COOKIE`` data (respecting the
+        ``request_order`` ini setting) instead of ``$_REQUEST``.
 
     .. php:method:: getGet([$index = null[, $filter = null[, $flags = null]]])