Re: Making addslashes() multibyte aware

Hi all, On Sat, Dec 14, 2013 at 1:22 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > escapeshellargs()/fgetcsv() have multibyte char support via mblen() which > depends on LC_TYPE, but addslashes() don't take into count MBCS at all. > > addslashes() could behave like escapeshellargs(). Current addslashes() > is not usable with SJIS/BIG5/etc. > > Depending on locale is problematic. Is it safe with multi threaded SAPI? > Using mbstring feature and introduce encoding php.ini setting might be > better. > > Any comment making addslashes() locale aware? and/or current > escapeshellargs()/fgetcsv() implementation? > I don't think locale based MBCS support is optimum, but I'll add it to addslashes() for now. Question is where should I start? It's security issue for certain char encodings such as SJIS/BIG5. I'll fix php_addslashes(). Therefore, any functions that use it internally are affected. e.g. var_export(), etc. Users are not affected as long as they are using correct locale. Should I fix this from 5.3? Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net