0

Some of the old PHP string functions for example explode() are working with UTF-8 strings, but they don't work properly on malformed UTF-8 strings. Is this a security issue? Is it possible to avoid string validation with malformed UTF-8 strings somehow?

It is hard to make a list of this functions. I think every core PHP string function is affected somehow. For example strpos does not give the right position in a string, strlen, does not give the right length. So I guess htmlentities, htmlspecialchars, etc... are affected as well, but it is more complicated, because some of them has an UTF-8 flag, some of them is not UTF-8 compatible, like strpos, some of them does not work with malformed UTF-8, etc... I can do a search after I have a working example, so that's what I am looking for.

It is enough for me for instance something like:

  • send 2 malformed string to the server, which in theory I cannot check with these functions
  • concat them with implode, and get something malicious, for example XSS.

Is this possible? I don't understand fully how UTF-8 or how malformed UTF-8 works...

Improve this question
7
  • 2
    add an example?
    – AK_
    Jun 8, 2014 at 23:20
  • Yes, that's the question, add an example if possible, or explain why it isn't possible.
    – inf3rno
    Jun 8, 2014 at 23:26
  • Since when is explode() doing any string validations? Or what do you mean with string validations? User input should always be validated before doing anything with them anyways.
    – Xatenev
    Jun 9, 2014 at 0:03
  • Is it possible to list other functions which don't work "properly" when given malformed UTF-8 strings? Knowing PHP I bet there's a bunch, but also typical of PHP.. I find any solid documentation on this...
    – thexacre
    Jun 9, 2014 at 0:30
  • PHP strings are just binary data. The character encoding only matters when you work with specific functions that assume a specific encoding (i. e., they have an encoding or charset parameter).
    – Gumbo
    Jun 9, 2014 at 5:16

1 Answer 1

Reset to default
1

The explode() function does not use any encoding. It simply splits a sequence of bytes at a subsequence of bytes. Whether those bytes are valid characters in the encoding you happen to use is outside the scope of this function.

So explode() works the same for any string, be it a valid UTF-8 sequence or an invalid UTF-8 sequence.

If you want to validate the strings against a particular encoding before the split operation, you're free to use mb_check_encoding().

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .