Given certain multibyte character sets, am I correct in assuming that the following doesn't do what it was intended to do?\[code\]$string = str_replace('"', '\\"', $string);\[/code\]In particular, if the input was in a character set that might have a valid character like 0xbf5c, so an attacker can inject 0xbf22 to get 0xbf5c22, leaving a valid character followed by an unquoted double quote (").Is there an easy way to mitigate this problem, or am I misunderstanding the issue in the first place?(In my case, the string is going into the value attribute of an HTML input tag: echo 'input type="text" value="' . $string . '">'
EDIT: For that matter, what about a function like preg_quote()? There's no charset argument for it, so it seems totally useless in this scenario. When you DON'T have the option of limiting charset to UTF-8 (yes, that'd be nice), it seems like you are really handicapped. What replace and quoting functions are available in that case?
EDIT: For that matter, what about a function like preg_quote()? There's no charset argument for it, so it seems totally useless in this scenario. When you DON'T have the option of limiting charset to UTF-8 (yes, that'd be nice), it seems like you are really handicapped. What replace and quoting functions are available in that case?