RE: [PHP4BETA] Dangerous PCRE security error

> -----Original Message----- > From: Andrei Zmievski [mailto:andrei@ispi.net] > Sent: Monday, October 18, 1999 06:56 PM > To: Samuel Liddicott > Cc: php4beta@lists.php.net > Subject: Re: [PHP4BETA] Dangerous PCRE security error > > > Samuel Liddicott wrote: > > look: GetDebugLine( [' defmenuopt(e, 0, "Check", '] [\2] > > [');'] ) > > > > Thats not valid code, so its invalid. My point was, if some > escaping was > > possible, it might be made valid by use of AddSlashes... Well to be simple, if I want to replace the matched text with the result of a function, I need the replace-pattern which will be eval'd to be some valid and safe php that can be eval'd. If I want to replace occurances of 'patt.*n' with the results of GetReplacement($match) this is the general way to do it. pcre_replace('/patt.*n/e','GetReplacement("\\0")',$MyText); And this *will* actually call GetReplacement with the matched pattern as a string parameter. The problem is that if the string parameter contains double quotes(") it will close the function-parameter string quotes and then the match may be executed itself if it is written with this in mind. This would do the trick, but it isn't allowed: pcre_replace('/patt.*n/e','GetReplacement("'.\\0.'")',$MyText); I'm sure you see why. This severly limits the usefullness of /e If /ea or something also replaces any " in the \\0 \\1 etc patterns before substituting them into the eval string, then everything will be OK. If course if my entire eval string is enclosed in " marks (and not ' marks as above) then other characters need escaping. So what I'm saying is: the /e examples in the web page are dangerous and without wanrning, and therefore also of very limited use. > Adding slashes is not a real solution because you wouldn't want > to backslash > all ' or " and also having it be automated will result in more confusion. You would. As soon as the code is eval'd, all the slashes will pop back out again. SAm