What are the potential pitfalls of using preg_replace in PHP?

One potential pitfall of using preg_replace in PHP is that it can be vulnerable to Regular Expression Denial of Service (ReDoS) attacks, where a malicious user can craft a regex pattern that causes the function to hang indefinitely. To mitigate this risk, you can set a timeout for the function using the `PCRE_JIT_STACKLIMIT` option. 

// Set a stack limit to prevent ReDoS attacks
ini_set('pcre.jit', 0);
ini_set('pcre.jit_stack_limit', 100000);

// Example usage of preg_replace with stack limit
$pattern = '/(foo|bar)+/';
$replacement = 'baz';
$string = 'foobarfoobarfoobar';
$result = preg_replace($pattern, $replacement, $string);
echo $result;

Keywords

preg_replace PHP regular expressions security vulnerabilities code injection

Related Questions