Or trying to use data from external variables without first checking to see if that data exists. For example, you should never use any of the following:
$foo = $_POST['foo']; // or $_GET, $_SESSION, $_COOKIE, et. al.
if($_POST['submit']) {
// ...
}
echo "Why hello there, $_POST[foo]!";
// etc. etc.