Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70674
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.182 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXbjh7EyzRf_uahHp0rfs21efqReHZKQchvB8CGjNc_Qaw@mail.gmail.com>
References: <CAGa2bXbjh7EyzRf_uahHp0rfs21efqReHZKQchvB8CGjNc_Qaw@mail.gmail.com>
Date: Tue, 17 Dec 2013 05:44:02 +0900
Message-ID: <CAGa2bXbGdC-6hcdEdQmzUn8xVKLa5Ro9NyGyFkhuMueoXuoing@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1132ecf09e84a304edace1bc
Subject: Re: Making addslashes() multibyte aware
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1132ecf09e84a304edace1bc
Content-Type: text/plain; charset=UTF-8

Hi all,

On Sat, Dec 14, 2013 at 1:22 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> escapeshellargs()/fgetcsv() have multibyte char support via mblen() which
> depends on LC_TYPE, but addslashes() don't take into count MBCS at all.
>
> addslashes() could behave like escapeshellargs(). Current addslashes()
> is not usable with SJIS/BIG5/etc.
>
> Depending on locale is problematic. Is it safe with multi threaded SAPI?
> Using mbstring feature and introduce encoding php.ini setting might be
> better.
>
> Any comment making addslashes() locale aware? and/or current
> escapeshellargs()/fgetcsv() implementation?
>

I don't think locale based MBCS support is optimum, but I'll add it to
addslashes() for now.

Question is where should I start?
It's security issue for certain char encodings such as SJIS/BIG5.

I'll fix php_addslashes(). Therefore, any functions that use it internally
are affected. e.g. var_export(), etc. Users are not affected as long as
they are using correct locale.

Should I fix this from 5.3?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1132ecf09e84a304edace1bc--