Im converting my site to utf, which is mostly done except there is legacy code which needs to make use of stripslashes()
I've heard reports that stripslashes can corrupt utf data, but Im not sure I understand why. utf sets the upper bit for all non-first characters (to be compatble with ASCII), so is it safe to run on utf data or not?
Are there potential security vulnerabilities if I try to run stripslashes on utf data. I ran a few tests using invalid utf code with slashes, but wasnt able to come up with any
I don't see a problem with UTF-8. In fact, most ASCII functions are UTF-8-safe because it is ASCII-compatible. (You only have to worry about lengths and mid-string insertion and deletion.)
UTF-16 and -32, however, are a problem because they may use characters with ASCII values (<0x80) to represent higher codepoints, which may be misinterpreted as ASCII slashes or quotes.
Example: "⁜!" (U+205C U+21) in UTF-16BE is 20 5c 00 21 which may be interpreted as " \0!" (where 0 is the NUL byte) and subsequently have its second character removed, corrupting the string.