I have used http_build_query numerous times in the past and I’ve never had to pay attention to the third parameter before: arg_separator. I am making use of a great Curl wrapper to abstract some of the more mundane setup tasks associated with a Curl request. Initially I had constructed the setup of CURLOPT_POSTFIELDS as follows:

$url = 'http://rest-toolkit/api/users/5';
$response = $curl->post($url,
    $vars = array(
        'username' => 'baz',
        'password' => 'bar'
    )
);

...

curl_setopt($handle,
    CURLOPT_POSTFIELDS,
    http_build_query($vars)
);

Upon receiving the request, my script was showing $_POST variables as follows:

Array
(
    [username] => baz
    [amp;password] => bar
)

Thanks to a comment on the http_build_query page regarding the use of the third parameter, I quickly realized that my php.ini setting for arg_separator.output was in fact set to &. The quick fix:

curl_setopt($handle,
    CURLOPT_POSTFIELDS,
    http_build_query($vars, '', '&')
);

And the result:

Array
(
    [username] => baz
    [password] => bar
)