What are the potential pitfalls of using preg_replace() in PHP for string replacement?

One potential pitfall of using preg_replace() in PHP for string replacement is that it can be vulnerable to regex injection attacks if user input is directly passed into the pattern parameter. To mitigate this risk, it's important to properly escape any user input that is used in the regex pattern. 

$user_input = $_POST['input']; // Assume this is user input
$escaped_input = preg_quote($user_input, '/');
$replacement = 'replacement_text';
$subject = 'original_text';

$result = preg_replace('/' . $escaped_input . '/', $replacement, $subject);
echo $result;

Keywords

preg_replace string replacement PHP regular expressions vulnerabilities

Related Questions