Re: Making addslashes() multibyte aware
Hi all,
On Sat, Dec 14, 2013 at 1:22 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> escapeshellargs()/fgetcsv() have multibyte char support via mblen() which
> depends on LC_TYPE, but addslashes() don't take into count MBCS at all.
>
> addslashes() could behave like escapeshellargs(). Current addslashes()
> is not usable with SJIS/BIG5/etc.
>
> Depending on locale is problematic. Is it safe with multi threaded SAPI?
> Using mbstring feature and introduce encoding php.ini setting might be
> better.
>
> Any comment making addslashes() locale aware? and/or current
> escapeshellargs()/fgetcsv() implementation?
>
I don't think locale based MBCS support is optimum, but I'll add it to
addslashes() for now.
Question is where should I start?
It's security issue for certain char encodings such as SJIS/BIG5.
I'll fix php_addslashes(). Therefore, any functions that use it internally
are affected. e.g. var_export(), etc. Users are not affected as long as
they are using correct locale.
Should I fix this from 5.3?
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net
Thread (7 messages)