Re: Re: Making addslashes() multibyte aware

On 16 December 2013 12:44, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > I don't think locale based MBCS support is optimum, but I'll add it to > addslashes() for now. I don't think basing behaviour on the locale is a great idea (as evidenced by the various issues with Turkish and Azeri over the years). Could we just add an explicit encoding parameter like htmlspecialchars()? > Question is where should I start? > It's security issue for certain char encodings such as SJIS/BIG5. Is there a case other than database access (where we've been directing users to better APIs like PDO and mysqli for several years, at least) where this is likely to cause security issues? > I'll fix php_addslashes(). Therefore, any functions that use it internally > are affected. e.g. var_export(), etc. Users are not affected as long as > they are using correct locale. > > Should I fix this from 5.3? This feels like it has the potential to be a really nasty implicit BC break. I don't think we'd want to change default behaviour on any stable branch, honestly. Adam