note 116884 added to function.preg-replace

I have been filtering every userinput with preg_replace since 6 Years now and nothing happened. I am running PHP 5.6.6 and because of historical reasons I still do not use mysqli. Now i noticed that this filter [^0-9a-zA-Z_ -|:\.] won't filter anything from a Sleeping-Hack-String like %' AnD sLeep(3) ANd '1%: preg_replace ( '/[^0-9a-zA-Z_ -|:\.]/', '', "%' AnD sLeep(3) ANd '1%" ); The reason is, that the fourth Minus has to be escaped! Fix: [^0-9a-zA-Z_ \-|:\.] I tell you because I did not know this and I am pretty sure btw. maybe in older versions of PHP some did not have to escape this minus. Those hacks did not work in the old days, because formerly I have been testing against this. Greetings ---- Server IP: 72.52.91.14 Probable Submitter: 85.214.223.136 ---- Manual Page -- http://php.net/manual/en/function.preg-replace.php Edit -- https://master.php.net/note/edit/116884 Del: integrated -- https://master.php.net/note/delete/116884/integrated Del: useless -- https://master.php.net/note/delete/116884/useless Del: bad code -- https://master.php.net/note/delete/116884/bad+code Del: spam -- https://master.php.net/note/delete/116884/spam Del: non-english -- https://master.php.net/note/delete/116884/non-english Del: in docs -- https://master.php.net/note/delete/116884/in+docs Del: other reasons-- https://master.php.net/note/delete/116884 Reject -- https://master.php.net/note/reject/116884 Search -- https://master.php.net/manage/user-notes.php