Re: Re: Making addslashes() multibyte aware
On 16 December 2013 12:44, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> I don't think locale based MBCS support is optimum, but I'll add it to
> addslashes() for now.
I don't think basing behaviour on the locale is a great idea (as
evidenced by the various issues with Turkish and Azeri over the
years). Could we just add an explicit encoding parameter like
htmlspecialchars()?
> Question is where should I start?
> It's security issue for certain char encodings such as SJIS/BIG5.
Is there a case other than database access (where we've been directing
users to better APIs like PDO and mysqli for several years, at least)
where this is likely to cause security issues?
> I'll fix php_addslashes(). Therefore, any functions that use it internally
> are affected. e.g. var_export(), etc. Users are not affected as long as
> they are using correct locale.
>
> Should I fix this from 5.3?
This feels like it has the potential to be a really nasty implicit BC
break. I don't think we'd want to change default behaviour on any
stable branch, honestly.
Adam
Thread (7 messages)