note 58027 added to function.parse-ini-file

[A feature request for a third parameter, to turn off the following insecure behaviour has been submitted: http://bugs.php.net/bug.php?id=34949 - I'm just documenting it here so that people are aware that they need to take the insecurity of the current behaviour into consideration when programming.] Be warned that, in its current (2-argument) form, this function should be avoided when processing user-provided ini files, as data leakage may occur if the user provides an ini file with unquoted string values. To avoid this problem, it's vital that if your program stores any sensitive data in constants, that you either pre-scan the ini file for unquoted strings, or that you do not use this function. A suitable pre-parse parser might be as follows. This assumes that there are no non-word (a-zA-Z0-9_) characters in your keys, and minimises whitespace. It tries to convert intelligently, like so: value1 = value ; this is a comment value2 = value; with semicolon in to value1 = "value" ; this is a comment value2 = "value; with semicolon in" <?php $file = file_get_contents('user_provided.ini'); $file2 = preg_replace('/^ (\s*\w+\s*=\s*) # Part \1 - the key and initial whitespace. ( # Part \2 - the value to be quoted (?:(?!\s;)[^"\r\n]) # Anything but \r, ", \s;, \n *? # As little as possible of that, minimise whitespace. ) ( # Part \3 - everything after the value \s* # Optional whitespace. (?:\s;.*)? # Optional comment preceded by a space ) $/mx', '\1"\2"\3', $file); file_put_contents('user_provided.ini2', $file2); ?> ---- Manual Page -- http://www.php.net/manual/en/function.parse-ini-file.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+58027 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+58027&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+58027&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+58027&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+58027&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+58027&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+58027&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+58027&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+58027&report=yes Search -- http://master.php.net/manage/user-notes.php