note 111917 added to function.wordwrap

(Re: kouber at php dot net). Testing out your function, I can confirm that it works, and it works very well. However, others that intend to use your function need to be aware that if they use it in conjunction with unverified data (such as raw user input from $_POST, $_GET, etcetera), they are creating potential attack vectors that can be exploited by hackers via script requests containing malicious code. This is because your function is using the preg_replace function in conjunction with the "e" flag (in order to allow the chunk_split bit to execute), which can allow execution of arbitrary code. Solution: If there is any possibility that $str may contain unverified data (such as raw user input), ensure that the contents of $str is sanitized (such as by using htmlentities/htmlspecialchars/etc) prior to sending it to wrap($str,...). Not a criticism; I intend to use your function, because I like it. However, just posting this as a note to other users that may not be aware of the importance of data sanitation. ---- Server IP: 113.20.13.217 Probable Submitter: 203.142.141.197 ---- Manual Page -- http://php.net/manual/en/function.wordwrap.php Edit -- https://master.php.net/note/edit/111917 Del: integrated -- https://master.php.net/note/delete/111917/integrated Del: useless -- https://master.php.net/note/delete/111917/useless Del: bad code -- https://master.php.net/note/delete/111917/bad+code Del: spam -- https://master.php.net/note/delete/111917/spam Del: non-english -- https://master.php.net/note/delete/111917/non-english Del: in docs -- https://master.php.net/note/delete/111917/in+docs Del: other reasons-- https://master.php.net/note/delete/111917 Reject -- https://master.php.net/note/reject/111917 Search -- https://master.php.net/manage/user-notes.php