note 116884 deleted from function.preg-replace by crell

Note Submitter: Nibbels ---- I have been filtering every userinput with preg_replace since 6 Years now and nothing happened. I am running PHP 5.6.6 and because of historical reasons I still do not use mysqli. Now i noticed that this filter [^0-9a-zA-Z_ -|:\.] won't filter anything from a Sleeping-Hack-String like %' AnD sLeep(3) ANd '1%: preg_replace ( '/[^0-9a-zA-Z_ -|:\.]/', '', "%' AnD sLeep(3) ANd '1%" ); The reason is, that the fourth Minus has to be escaped! Fix: [^0-9a-zA-Z_ \-|:\.] I tell you because I did not know this and I am pretty sure btw. maybe in older versions of PHP some did not have to escape this minus. Those hacks did not work in the old days, because formerly I have been testing against this. Greetings