note 112867 deleted from function.mb-check-encoding by salathe

From: Date: Sat, 14 Aug 2021 09:08:25 +0000
Subject: note 112867 deleted from function.mb-check-encoding by salathe
References: 1  Groups: php.notes 
Request: Send a blank email to php-notes+get-216792@lists.php.net to get a copy of this message
Note Submitter: Stefan W ---- Note that the algorithm in javalc6's comment checks UTF-8 compliance by the letter of the specs. This means that overlong byte sequences will pass. For example: 0xC0 0xAF can be used to encode U+002F, the slash character. While legal, this character is more properly encoded as 0x2F. Overlong sequences are unnecessary and should be avoided; they have been - and still are - used in various attacks (like directory traversal attacks). It also means that high Unicode characters outside the Basic Multilingual Plane will pass; this means characters above U+FFFF, composed of 4+ bytes (hieroglyhps, cuneiform, etc). You need to decide if you want those characters or not. If you do, be aware that they often cause compatibility problems (for example with JSON and some databases). mb_check_encoding(), mb_detect_encoding(x, y, TRUE), and the other comments up to now all reject characters outside the BMP and overlong sequences.

« previous php.notes (#216792) next »