add preg_quote_replacement() function
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
$pattern = '/[[name]]/';
$template = 'My name is [[name]]';
preg_replace($pattern, $_POST['name'], $template);
This is prone to injection of any match from the pattern if user supplies for example Tomas$1Fejfar. There is a preg_quote function that can be used to escape special chars in template. There should be same function that would escape the replacement.
preg_quote_replacement($_POST['name']); // Tomas\$1Fejfar
IMHO it is enough to escape backslash and dollars with backslash, but I am not sure.
Currently the replacement must be escaped using userland function that makes it prone to mistakes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names preg_quote() and preg_replace() but provides no files or tests. Start by tracing their implementation and replacement parsing, then verify the proposed handling of backslashes and dollar signs against the shown injection case. Done means defining the escaping contract, implementing the new function, and adding coverage for replacement strings such as Tomas$1Fejfar.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100