Wow, that's a pretty serious flaw right there. Pretty messy looking code too, this part in particular: if($city_get == "Delhi-ncr")$city_get = "delhi-ncr"; — would it not have been easier to use strtolower instead? This doesn't appear to be related directly to the Groupon site but rather a special deals portal that is a subdomain of the Groupon India website. I tried doing this on other parts of the site and only <a href="http://getaways.groupon.co.in/" rel="nofollow">http://getaways.groupon.co.in/</a> seems to be affected.<p>Aside: I didn't know Groupon was running on PHP, I always assumed it was built in something else.
Do not blame this on Groupon's US engineering team. This is code from crazeal.com, which Groupon acquired (check the 'was thrown in' part of the exception message).<p>A lot of Groupon's international sites are on different platforms than the Groupon US site. This is because they expanded by acquiring the leading daily deals sites in all the countries they moved in to. There's been a big project within the company to move all international markets onto a single system but I'm sure you can imagine how difficult and time consuming of a project that is.