php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #26244 regular expression order matters when it shouldn't
Submitted: 2003-11-13 14:36 UTC Modified: 2003-11-13 15:05 UTC
From: willn at umich dot edu Assigned:
Status: Not a bug Package: Regexps related
PHP Version: 4.3.2 OS: Solaris 5.8
Private report: No CVE-ID: None
 [2003-11-13 14:36 UTC] willn at umich dot edu
Description:
------------
Within the "anti-match" square brackets, order shouldn't make a difference, but it does. I'm writing a simple anti-injection attack filter to pull out all the illegal characters, and leave the ones that I want. Unfortunately, I found that with this particular combination, I've been getting this error message:

[Thu Nov 13 14:25:41 2003] [error] PHP Warning:  Compilation failed: range out of order in character class at offset 4 in /usr/local/projects/vote-dev/public/test.php on line 5

The code below demonstrates the simplest case I could find that would replicate the problem. Swapping the order a little bit makes it work a little better - as you can see that the $a and $f variables have some issues.


Reproduce code:
---------------
<pre><?php
    $text = 'This, is my - "favorite".';
    $a = preg_replace( '/[^,-"]/', '', $text );
    $b = preg_replace( '/[^,"-]/', '', $text );
    $c = preg_replace( '/[^-,"]/', '', $text );
    $d = preg_replace( '/[^-",]/', '', $text );
    $e = preg_replace( '/[^",-]/', '', $text );
    $f = preg_replace( '/[^"-,]/', '', $text );
    echo "$text\na:$a\nb:$b\nc:$c\nd:$d\ne:$e\nf:$f";
?></pre>

Expected result:
----------------
This, is my - "favorite".
a:,-""
b:,-""
c:,-""
d:,-""
e:,-""
f:,-""

Actual result:
--------------
This, is my - "favorite".
a:
b:,-""
c:,-""
d:,-""
e:,-""
f:,""

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-11-13 15:05 UTC] jay@php.net
The '-' character means range when it's between the 
[ and ]. You need to put it as the first character or the 
second character between the [^ and ], which is why $b, 
$c, $d and $e work fine. 
 
J 
 [2010-11-25 11:05 UTC] lukas_panek at yahoo dot com
Thank you.
Escaping the "-" character with a bakslash works also.
e.g.: preg_match('/^<!--([a-zA-Z_\-\.]*)-->/',$radka,$match)
Wouldnt have found out without this thread
L
 
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Tue Nov 24 21:01:23 2020 UTC