Antwort: RE: [PHP] Re: template in message string

Dan Rossi wrote: >an example line would be nice ?? and basically my string will be returned >like > >$string = "Something $var1 something else $var2"; > >from > >$string = "Something {var1} something else {var2}"; > >that preg statement i posted seemed to work for me ?? I'm not saying your regex is wrong I'm just saying it is potentially dangerouse (see below). Another thing is that \ are not escaped in your pattern. This can result in an error when you are extending your pattern later. According to manual \ have to be escaped even in singelquoted strings. But php seems to be fault tolerant and will interpret any \ in front of a non metacharacter as a single \. >so therefore > >$var1 = "test"; >$var2 = "test2"; > >echo $string; would hopefully return Something test something else test2 > >how can i do this without eval it didnt seem to working within a function :\ preg_replace('/\\{([a-zA-Z0-9]+?)\\}/e', '$\\1', $string) The e modifier will make the replacement to be interpreted as legal php code. So basically it is using the eval function inside the replacement without you having to worry about calling eval. The replaced code gets parsed by PHP and any invalid syntax is reported as a fatal error. if I use the pattern '/\\{(.+?)\\}/e' the following is possible: $string = "Something {var} something else \\{\";}{_SESSION['pass']='somethingelse';}" This will result in a string like: "Something "$var something else \$";$_SESSION['pass']='somethingelse';" If the above string is passed to eval unchanged this could lead to a session variable with name pass being chagned to 'somethingelse'. Although it is kind of artifical what I'm trying to say is that this leaves open a security hole. Unless you are sure that no data from external sources can be introduced into your pattern it is perfectly allright but if you include any data from external sources even other programmers that use your function they might use a similar exploit to the above to introduce maliciouse code into your application. By keeping the valid input inbetween matched {} to only letters and digits it becomes virtually impossible for external sources to introduce malicouse code. The most they can do is create a variable that will replace the text. And this variable will have to be setup beforehand to be used. That reminds me your register_globals is off right? And by introducing backticks ` one could actually execute code on the server. At least if backticks are allowed. Instead of using the e modifier you might want to check this (its slightly faster! if more than one {} occurs preg_replace_callback('/\\{([a-zA-Z0-9]+?)\\}/', 'callbackFunction', $string) function callbackFunction($match) // $match[0] = {var1}, $match[1] = var1 { if(isset($$match[1])) return $$match[1]; } Regards Stefan