Description:
------------
Within the "anti-match" square brackets, order shouldn't make a difference, but it does. I'm writing a simple anti-injection attack filter to pull out all the illegal characters, and leave the ones that I want. Unfortunately, I found that with this particular combination, I've been getting this error message:

[Thu Nov 13 14:25:41 2003] [error] PHP Warning:  Compilation failed: range out of order in character class at offset 4 in /usr/local/projects/vote-dev/public/test.php on line 5

The code below demonstrates the simplest case I could find that would replicate the problem. Swapping the order a little bit makes it work a little better - as you can see that the $a and $f variables have some issues.


Reproduce code:
---------------
<pre><?php
    $text = 'This, is my - "favorite".';
    $a = preg_replace( '/[^,-"]/', '', $text );
    $b = preg_replace( '/[^,"-]/', '', $text );
    $c = preg_replace( '/[^-,"]/', '', $text );
    $d = preg_replace( '/[^-",]/', '', $text );
    $e = preg_replace( '/[^",-]/', '', $text );
    $f = preg_replace( '/[^"-,]/', '', $text );
    echo "$text\na:$a\nb:$b\nc:$c\nd:$d\ne:$e\nf:$f";
?></pre>

Expected result:
----------------
This, is my - "favorite".
a:,-""
b:,-""
c:,-""
d:,-""
e:,-""
f:,-""

Actual result:
--------------
This, is my - "favorite".
a:
b:,-""
c:,-""
d:,-""
e:,-""
f:,""