note 74258 added to ref.regex

The fact that 'regex' functions are not binary safe have some very important security implications for people who are using ereg to validate their input data. Suppose I have an expression: <?php $pattern = '^[[:alnum:]]*$'; ?> This should match any number of alphanumeric characters, right? Well, if the string you're matching is not binary, sure. However, say we have a null-byte tossed in the string: <?php $string = chr(0) . "<script>alert('xss')</script>"; echo ereg($pattern, $string); ?> Will return true. Note that it is trivially easy to inject null bytes into PHP parameters: index.php?content=%00ASCII Scary. So unless you really know what you're doing, just use the PCRE preg_* functions. ---- Server IP: 216.194.113.175 Probable Submitter: 68.197.170.249 ---- Manual Page -- http://www.php.net/manual/en/ref.regex.php Edit -- https://master.php.net/note/edit/74258 Del: integrated -- https://master.php.net/note/delete/74258/integrated Del: useless -- https://master.php.net/note/delete/74258/useless Del: bad code -- https://master.php.net/note/delete/74258/bad+code Del: spam -- https://master.php.net/note/delete/74258/spam Del: non-english -- https://master.php.net/note/delete/74258/non-english Del: in docs -- https://master.php.net/note/delete/74258/in+docs Del: other reasons-- https://master.php.net/note/delete/74258 Reject -- https://master.php.net/note/reject/74258 Search -- https://master.php.net/manage/user-notes.php