Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71181
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.219.51 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXauxj6Sca8qYk2cxQ=TeG4bjWgcv-Aqy3cJe35ap72Yfw@mail.gmail.com>
References: <CAGa2bXauxj6Sca8qYk2cxQ=TeG4bjWgcv-Aqy3cJe35ap72Yfw@mail.gmail.com>
Date: Thu, 16 Jan 2014 13:18:36 +0100
Message-ID: <CAF+90c-ZgsCczU71TJap1yeaNhKgQeoUR5oLKwwHHaoOD8z_ig@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b33d3cec3a2a604f0156cf5
Subject: Re: [PHP-DEV] [RFC] Multibyte char handling
From: nikita.ppv@gmail.com (Nikita Popov)

--047d7b33d3cec3a2a604f0156cf5
Content-Type: text/plain; charset=ISO-8859-1

On Thu, Jan 16, 2014 at 12:50 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> addslashes() could be vulnerable via char encoding based attacks.
> It is needed to decide what counter measure we adopt.
> This is RFC for this issue.
>
> https://wiki.php.net/multibyte_char_handling
>
> Please comment.
> Thank you.
>

Please do *not* add encoding parameters to our existing string functions -
we have an mb extension and mb functionality should go there. Don't mix the
things, it will only lead to a lot of confusion. Right now it's obvious
which functions handle encoding how, no need to break that.

Nikita

--047d7b33d3cec3a2a604f0156cf5--