[natecavanaugh]

I think by 2006 magic auto globals was already off by default (4.2, which was released in 2002, was the one that turned it off, and though 4.2 was still widely used by the time jQuery came about, register_globals was considered bad practice in general by at least 2004, if not even earlier).

[hrktb]

good point. Your timeline is accurate, and while PHP installs tend to be out of date and people following tutorials would just turn off security features, by 2006 the trend should have been in decline, yes.

More than anything, the crazy thing for me is that jQuery seemed to have been there from the wake of the web, when it came out only one year before the iPhone.