php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #17856 quotemeta() does not escape all correct meta characters
Submitted: 2002-06-19 22:05 UTC Modified: 2002-06-20 04:04 UTC
From: robbat2 at orbis-terrarum dot net Assigned:
Status: Wont fix Package: Regexps related
PHP Version: 4.1.2 OS: Linux, Apache 2.0.36
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: robbat2 at orbis-terrarum dot net
New email:
PHP Version: OS:

 

 [2002-06-19 22:05 UTC] robbat2 at orbis-terrarum dot net 
quotemeta() only escapes:
. \\ + * ? [ ^ ] ( $ )

To properly escape traditional characters for regexps, it is also nessecary to escape '-' and '|', as the are the range and OR operators respectively.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-06-20 02:22 UTC] derick@php.net 
We already have preg_quote for this..

Derick
 [2002-06-20 03:54 UTC] robbat2 at orbis-terrarum dot net 
I'm writing code for phpMyAdmin, and we try to avoid the PCRE because some people don't have it enabled. And we still support people that are that don't have it enabled.

Quotemeta() should escape all of the correct characters for non-Perl regular expressions.

In the name of correctness, PHP should have this.
 [2002-06-20 04:04 UTC] derick@php.net 
From the manual:

quotemeta -- Quote meta characters
Description
string quotemeta ( string str)

Returns a version of str with a backslash character (\) before every character that is among these:

. \\ + * ? [ ^ ] ( $ )


Seems totally clear to me that this is not a bug. As it's not a bug, your 'report' should have the feature/request status, but we already have a function for this, preg_quote. It sounds stupid to make a new function that does exactly the same.
You may argue that we can change the quotemeta() function, but for all we know this might break scripts, so we're not going to do that.
And please don't change the status back to open again,

Thank you.
Derick
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat Apr 27 08:01:29 2024 UTC