php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #17856 quotemeta() does not escape all correct meta characters
Submitted: 2002-06-19 22:05 UTC Modified: 2002-06-20 04:04 UTC
From: robbat2 at orbis-terrarum dot net Assigned:
Status: Wont fix Package: Regexps related
PHP Version: 4.1.2 OS: Linux, Apache 2.0.36
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: robbat2 at orbis-terrarum dot net
New email:
PHP Version: OS:

 

 [2002-06-19 22:05 UTC] robbat2 at orbis-terrarum dot net
quotemeta() only escapes:
. \\ + * ? [ ^ ] ( $ )

To properly escape traditional characters for regexps, it is also nessecary to escape '-' and '|', as the are the range and OR operators respectively.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-06-20 02:22 UTC] derick@php.net
We already have preg_quote for this..

Derick
 [2002-06-20 03:54 UTC] robbat2 at orbis-terrarum dot net
I'm writing code for phpMyAdmin, and we try to avoid the PCRE because some people don't have it enabled. And we still support people that are that don't have it enabled.

Quotemeta() should escape all of the correct characters for non-Perl regular expressions.

In the name of correctness, PHP should have this.
 [2002-06-20 04:04 UTC] derick@php.net
From the manual:

quotemeta -- Quote meta characters
Description
string quotemeta ( string str)

Returns a version of str with a backslash character (\) before every character that is among these:

. \\ + * ? [ ^ ] ( $ )


Seems totally clear to me that this is not a bug. As it's not a bug, your 'report' should have the feature/request status, but we already have a function for this, preg_quote. It sounds stupid to make a new function that does exactly the same.
You may argue that we can change the quotemeta() function, but for all we know this might break scripts, so we're not going to do that.
And please don't change the status back to open again,

Thank you.
Derick
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Mar 29 12:01:27 2024 UTC