Description:
------------
preg_replace does not escape $ character. If double quotes are used in 
replacement code, this enables unwanted injection of variables or even 
execution of PHP code.

My suggestion is to escape $ character and discourage use of single 
quotes in replacement code (because they're not compatible with the way 
$ and " are escaped).


Reproduce code:
---------------
// simple case:
preg_replace('/.*/e','strtoupper("$0")', '$foo');

// code execution:
class test
{
    function pwnd() {echo "pwnd!\n";}
    
    function replace($str)
    {
        preg_replace('/.*/e','strtoupper("$0")', $str);
    }
}

$t = new test();
$t->replace('{$this->pwnd()}');


Expected result:
----------------
$FOO
{$THIS->PWND()}

Actual result:
--------------
PHP Notice:  Undefined variable: foo
pwnd!