note 76688 added to function.preg-match

Maybe it will sound obvious, but I've encountered this a few times... If you are using preg_match() to validate user input, remember about including ^ and $ to your regex or take input from $matches[0] after successfully matching a pattern ie. preg_match('/[0-9]+/', '123 UNION SELECT ... --') will return TRUE, but when you it in a SQL statement, injected code will be probably executed(if you don't escape user argument). Note that $matches[0] == '123', so it can be used as a valid input. ---- Server IP: 212.108.64.191 Probable Submitter: 87.198.183.253 ---- Manual Page -- http://www.php.net/manual/en/function.preg-match.php Edit -- https://master.php.net/note/edit/76688 Del: integrated -- https://master.php.net/note/delete/76688/integrated Del: useless -- https://master.php.net/note/delete/76688/useless Del: bad code -- https://master.php.net/note/delete/76688/bad+code Del: spam -- https://master.php.net/note/delete/76688/spam Del: non-english -- https://master.php.net/note/delete/76688/non-english Del: in docs -- https://master.php.net/note/delete/76688/in+docs Del: other reasons-- https://master.php.net/note/delete/76688 Reject -- https://master.php.net/note/reject/76688 Search -- https://master.php.net/manage/user-notes.php