php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #79237 filter_var limited to 8192 characters in input string
Submitted: 2020-02-07 03:29 UTC Modified: 2020-02-07 10:43 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: murray at focus-computing dot com dot au Assigned:
Status: Verified Package: *Regular Expressions
PHP Version: 7.3Git-2020-02-07 (Git) OS: Debian 4.19.67-2+deb10u1 (2019-0
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: murray at focus-computing dot com dot au
New email:
PHP Version: OS:

 

 [2020-02-07 03:29 UTC] murray at focus-computing dot com dot au 
Description:
------------
I was testing some input being passed via a parameter to my script.  I was getting an error indicating that the value passed was invalid, yet it didn't contain any of the strings I was searching for.  
I went through the process of shortening the string and when I got below 8192 chars in length it worked, over 8192 chars in length it would fail.

I also tried this on PHP v7.1.32 and the exact same code on my Mac OSX which worked correctly.

Test script:
---------------
filter_var(trim($_REQUEST['parms']), FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => "/^((?!union select|union all|\'A=|select char).)*$/im")));

Expected result:
----------------
A) filter_var should handle strings longer than 8192 chars

OR

B) Add documentation to filter_var manual entry indicating maximum length of string.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-02-07 08:03 UTC] cmb@php.net
-Status: Open +Status: Feedback -Assigned To: +Assigned To: cmb
 [2020-02-07 08:03 UTC] cmb@php.net 
Please try again with pcre.jit=0 (unless you did already).  With
pcre.jit=1, I get PCRE2_ERROR_JIT_STACKLIMIT[1] internally.

[1] <https://www.pcre.org/current/doc/html/pcre2api.html#SEC31>
 [2020-02-07 09:41 UTC] murray at focus-computing dot com dot au
-Status: Feedback +Status: Assigned
 [2020-02-07 09:41 UTC] murray at focus-computing dot com dot au 
I tried pcre.jit=0 and this worked.
I'm not sure what that changes, or why it worked.  I'm happy, but perhaps we should add a comment to the online manual?
 [2020-02-07 10:43 UTC] cmb@php.net
-Status: Assigned +Status: Verified -Assigned To: cmb +Assigned To:
 [2020-02-07 10:43 UTC] cmb@php.net 
Thanks for the confirmation.

It seems to me there should be some hint available why that regex
match failed; maybe just set the last PCRE error, so a user can
get information by calling preg_last_error() (what could be
regarded as BC break, though).
 [2024-07-09 05:35 UTC] jeffrey597doss at outlook dot com 
I have read your article, it is very informative and helpful for me. I admire the valuable information you offer in your articles. Thanks for posting it (https://github.com)(https://www.my-labcorp.com)
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Oct 23 09:00:02 2025 UTC