Description:
------------
A simple regular expression that has worked for years in PHP 4 
suddenly fails under PHP 5. 

Reproduce code:
---------------
foreach($_GET as $val)
	{
		if ( preg_match("/[^a-z0-9_\-\+]/i", $val) )
		{			
			die("<p>Invalid request.</p>");
		}
	}

Expected result:
----------------
The above code is used to filter out bogus GET requests 
containing potential XSS attacks at the top of a script. It 
should allow all legitimate requests comprised of alphanumeric 
characters, underscores, and plus and minus signs, through, 
while kicking anything containing a character not included in 
the character class out,

Actual result:
--------------
The regex matches plus signs contained in query strings even 
though the plus sign is explicitly included in the negated 
character class. I believe it is being interpreted as a 
quantifier when it is meant to be taken literally, I have not 
been able to find any means of successfully including a 
literal plus sign in a character class under PHP 5 to date.