Critical PHP vulnerability being fixed (The H)

Why doesn't this work the other way around, i.e the web service should supply a list of which keys it supports and the "framework" should create a map of that (and perform a lookup on the incoming data from the client) instead of the "framework" creating a map of the incoming data from the client (and the service performs the lookup).

That way it could even generate a perfect hash to yield even better performance. And that is exactly how I have always coded web services in C so why does the PHP/Java/whatnot-crowd do it backwards?