#47501 [Opn->Fbk]: stripslashes() converts \0 into a null character

From: Date: Wed, 25 Feb 2009 13:37:34 +0000
Subject: #47501 [Opn->Fbk]: stripslashes() converts \0 into a null character
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-134191@lists.php.net to get a copy of this message 
 ID:               47501
 Updated by:       jani@php.net
 Reported By:      gazheyes at gmail dot com
-Status:           Open
+Status:           Feedback
 Bug Type:         Strings related
 Operating System: *
 PHP Version:      5.2.8
 New Comment:

Try this script instead:

<?php
var_dump($_GET['x'], stripslashes($_GET['x']));
?>


Previous Comments:
------------------------------------------------------------------------

[2009-02-25 11:15:51] gazheyes at gmail dot com

Description:
------------
Stripslashes appears to be converting null escapes into a null
character. I've tested other unicode characters from 0 to 100,000 and
only null escapes are converted. IMO you shouldn't be able to decode
null chars from a url like this. 

Marc Zimmerli originally found this bug.

Reproduce code:
---------------
the url contains page.php?x=\0

<?php
echo stripslashes($_GET['x']);
?>

Expected result:
----------------
0

Actual result:
--------------
null


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=47501&edit=1

Thread (5 messages)

« previous php.bugs (#134191) next »