PHP addcslashes() function syntax

user_9283315 0
Viewed 104

The manual page for the PHP addcslashes() function gives the following example:

addcslashes($not_escaped, "\0..\37!@\177..\377");

to escape all ASCII characters between 0 and 31 (= 037 octal). A user suggests the following improvement:

addcslashes($not_escaped, "\0..\37!@\@\177..\377");

to "protect original, innocent backslashes from stripcslashes".

Is there any documentation for the format of the charlist parameter? Specifically, what is the interpretation of the !@ sequence in the first example, and the !@\@ sequence in the second?

escaping php
1 Answers

It took me some time to find the obvious.

!@ is no special sequence, that are single characters which should be escaped. The only special input for addcslashes is char..char for a range.

\0..\37!@\177..\377 escapes the range 0..\37, the character !, the character @ and the range \177..\377

The suggestion with !@\@ is invalid (not clean) in my opinion. \@ is not masked in php (there is no special meaning behind it like \n) and it will be the same. So \ and @ (for a second time) are added to the character list. No magic and no special sequence behind this. The clean solution when you want to escape all non printable characters (0-37 and 177+), the @, !, \ is:

"\0..\37!@\\\177..\377"
user_17937190
Related