Edit report at https://bugs.php.net/bug.php?id=65079&edit=1
ID: 65079 Updated by: yohg...@php.net Reported by: masakielastic at gmail dot com Summary: mb_ereg_replace's e modifier should be deprecated Status: Open Type: Feature/Change Request Package: mbstring related Operating System: Any PHP Version: 5.5.0 Block user comment: N Private report: N New Comment: Comment for clarification. Not like preg_replace(), mb_ereg_replace()'s 'e' modifier is specified as separate parameter. preg_replace() allow to set 'e' modifier in regex and this made preg_replace() much more dangerous than mb_ereg_replace(). However, callback is much more secure. Therefore, implementation of mb_ereg_replace_callback() is highly encouraged. Previous Comments: ------------------------------------------------------------------------ [2013-06-21 00:23:30] masakielastic at gmail dot com Description: ------------ mb_ereg_replace's e modifier should be deprecated for prevent PHP's code execution and the explanation for using mb_ereg_replace_callback (since PHP 5.4.1) should be added in the manual. PHP: code execution via mb_ereg_replace http://vigilance.fr/vulnerability/PHP-code-execution-via-mb-ereg-replace-8711 The reason why preg_replace's e modifier was deprecated in PHP 5.5 can be applied to mb_ereg_replace's e modifier. http://www.php.net/manual/en/function.preg-replace.php https://wiki.php.net/rfc/remove_preg_replace_eval_modifier There is an example of implementation of mb_ereg_replace_callback as a user function. http://d.hatena.ne.jp/hnw/20110206 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=65079&edit=1
