On Thu, Jan 16, 2014 at 12:50 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> addslashes() could be vulnerable via char encoding based attacks.
> It is needed to decide what counter measure we adopt.
> This is RFC for this issue.
>
> https://wiki.php.net/multibyte_char_handling
>
> Please comment.
> Thank you.
>
Please do *not* add encoding parameters to our existing string functions -
we have an mb extension and mb functionality should go there. Don't mix the
things, it will only lead to a lot of confusion. Right now it's obvious
which functions handle encoding how, no need to break that.
Nikita