Description:
------------
The http_build_query() function allows people to see every members of an object (even private/protected) and it adds strange %00 in the result after every private member (like \0 is converted in hex.).

Reproduce code:
---------------
class test { 
private $foo;
private $bar;

function __constructor() {
$bar = 'meuh';
$foo = 'lala';
}

$obj = new test;
var_dump(http_build_query($obj));

Expected result:
----------------
It should ignore privates/protected.

Actual result:
--------------
It doesn't ignore private/protected and it adds %00 at the end of every private/protected members.