Avatar

my description of problem was wrong... (Bugs)

by Urfin® ⌂, Russia, Tuesday, February 02, 2010, 15:04 (5195 days ago) @ Alex

The original function looks like this:

function contains_special_characters($string)
{
if(preg_match("/([[:cntrl:]]|\255)/", $string)) return true; // control characters and soft hyphen
if(preg_match("/(\x{200b})/u", $string)) return true; // zero width space
return false;
}

original function was:

function contains_special_characters($string)
 {
  #if(!preg_match("/^[a-zA-Z0-9_\- ]+$/", $string)) return true; // only alphanumeric characters, "-", "_" and " " allowed
  if(preg_match("/([[:cntrl:]]|\255)/", $string)) return true; // not allowed: control characters and soft hyphen
  else return false;
 }

I'm afraid the u modifier causes the problem on your server (cannot reproduce it here, see this posting).

no, not 'u', but maybe [[:cntrl:]]?

What about this modification?

function contains_special_characters($string)
{
if(preg_match("/([[:cntrl:]]|\255)/", $string)) return true; // control characters and soft hyphen
return false;
}

mod above doesn't allow the 'ciryllic' user to publish a message on my server...
so I use only this part of code:

function contains_special_characters($string)
 {
  if(preg_match("/(\x{200b})/u", $string)) return true; // zero width space
  return false;
 }

Anyway this check isn't really important. The idea was to prevent users from specifying identical looking user names like already registered user names by not accepting invisible characters. However, this isn't very promising as unicode characters are allowed (for example: you could post with my name using the cyrillic "А").

yes, some 'bad guys' in several Russian forums use similar vulnerabilities in their purposes... until a moderator has noticed ;)

--
no bees - no honey,
no business - no money


Complete thread:

 RSS Feed of thread