note 83935 added to function.utf8-decode

Warning! This function contains a possible security risk when you try to convert escaped strings (see addslashes() and related functions). It reacts nasty on broken multibyte sequences. In UTF-8, follow-up bytes ALWAYS have the binary pattern 10xxxxxx, but this fact is not handled by utf8_decode in the way you would expect: If you pass a start byte (110xxxxx, 1110xxxx, 11110xxx - or even invalid sequences like 11111100), followed by one or more non-multibyte chars (0xxxxxxx), the start sequence "char" will be replaced by '?' (0x3F) and up to three following chars will disappear even if they are single-byte-chars (0xxxxxxx). So if you escape a string with a typical escape char like backslash, you would expect that your escaping would always survive a call to utf8decode because the escape char is in the assumed safe ascii range 0-127, but that is NOT the case! Try things like utf8_decode("test: ü\\\"123456") to check it out. To avoid problems take care that string-escaping always is the last step of data manipulation when you depend on leak-proof escaping. ---- Server IP: 217.160.72.57 Probable Submitter: 84.60.34.22 ---- Manual Page -- http://www.php.net/manual/en/function.utf8-decode.php Edit -- https://master.php.net/note/edit/83935 Del: integrated -- https://master.php.net/note/delete/83935/integrated Del: useless -- https://master.php.net/note/delete/83935/useless Del: bad code -- https://master.php.net/note/delete/83935/bad+code Del: spam -- https://master.php.net/note/delete/83935/spam Del: non-english -- https://master.php.net/note/delete/83935/non-english Del: in docs -- https://master.php.net/note/delete/83935/in+docs Del: other reasons-- https://master.php.net/note/delete/83935 Reject -- https://master.php.net/note/reject/83935 Search -- https://master.php.net/manage/user-notes.php