Is it possible to set a public object property via query string. For example if I have the following object $object->property; and the property is set to public, is it possible for a hacker to set the property via query string?
Yes, you are right. And I hope globals are turned off on your server, as potentialy this can also be a hole.