Re: [RFC] Multibyte char handling
| From: | Nikita Popov | Date: | Thu, 16 Jan 2014 12:18:36 +0000 |
| Subject: | Re: [RFC] Multibyte char handling | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-71181@lists.php.net to get a copy of this message | ||
On Thu, Jan 16, 2014 at 12:50 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> addslashes() could be vulnerable via char encoding based attacks.
> It is needed to decide what counter measure we adopt.
> This is RFC for this issue.
>
> https://wiki.php.net/multibyte_char_handling
>
> Please comment.
> Thank you.
>
Please do *not* add encoding parameters to our existing string functions -
we have an mb extension and mb functionality should go there. Don't mix the
things, it will only lead to a lot of confusion. Right now it's obvious
which functions handle encoding how, no need to break that.
Nikita