RE: [PHP4BETA] Dangerous PCRE security error

Perhaps another PCRE /e option, where the replace-string is a function name, which is called with one parameter which is the $match[] array, containing all the matched patterns. Sam > -----Original Message----- > From: Samuel Liddicott [mailto:sam@campbellsci.co.uk] > Sent: Tuesday, October 19, 1999 01:45 PM > To: Andrei Zmievski > Cc: php4beta@lists.php.net > Subject: RE: [PHP4BETA] Dangerous PCRE security error > > > > > > -----Original Message----- > > From: Andrei Zmievski [mailto:andrei@ispi.net] > > Sent: Monday, October 18, 1999 06:56 PM > > To: Samuel Liddicott > > Cc: php4beta@lists.php.net > > Subject: Re: [PHP4BETA] Dangerous PCRE security error > > > > > > Samuel Liddicott wrote: > > > look: GetDebugLine( [' defmenuopt(e, 0, "Check", '] [\2] > > > [');'] ) > > > > > > Thats not valid code, so its invalid. My point was, if some > > escaping was > > > possible, it might be made valid by use of AddSlashes... > > Well to be simple, if I want to replace the matched text with the > result of > a function, I need the replace-pattern which will be eval'd to be > some valid > and safe php that can be eval'd. > > If I want to replace occurances of 'patt.*n' with the results of > GetReplacement($match) this is the general way to do it. > pcre_replace('/patt.*n/e','GetReplacement("\\0")',$MyText); > > And this *will* actually call GetReplacement with the matched pattern as a > string parameter. > The problem is that if the string parameter contains double quotes(") it > will close the function-parameter string quotes and then the match may be > executed itself if it is written with this in mind. > > This would do the trick, but it isn't allowed: > > pcre_replace('/patt.*n/e','GetReplacement("'.\\0.'")',$MyText); > I'm sure you see why. > > This severly limits the usefullness of /e > > If /ea or something also replaces any " in the \\0 \\1 etc patterns before > substituting them into the eval string, then everything will be OK. If > course if my entire eval string is enclosed in " marks (and not ' marks as > above) then other characters need escaping. > > So what I'm saying is: the /e examples in the web page are dangerous and > without wanrning, and therefore also of very limited use. > > > Adding slashes is not a real solution because you wouldn't want > > to backslash > > all ' or " and also having it be automated will result in more > confusion. > > You would. As soon as the code is eval'd, all the slashes will > pop back out > again. > > SAm > > > -- > PHP 4 Beta