From e58e36fa97bc985e6d54a6679b698bf81495ef46 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 4 Jul 2024 18:24:39 +0200 Subject: [PATCH] Doc --- htdocs/main.inc.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index 511cc0a7bf2..559a652288e 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -158,9 +158,9 @@ function testSqlAndScriptInject($val, $type) // We check string because some hacks try to obfuscate evil strings by inserting non printable chars. Example: 'java(ascci09)scr(ascii00)ipt' is processed like 'javascript' (whatever is place of evil ascii char) // We should use dol_string_nounprintableascii but function is not yet loaded/available // Example of valid UTF8 chars: - // utf8=utf8mb3: '\x09', '\x0A', '\x0D', '\x7E' - // utf8=utf8mb3: '\xE0\xA0\x80' - // utf8mb4: '\xF0\x9D\x84\x9E' (but this may be refused by the database insert if pagecode is utf8=utf8mb3) + // utf8 or utf8mb3: '\x09', '\x0A', '\x0D', '\x7E' + // utf8 or utf8mb3: '\xE0\xA0\x80' + // utf8mb4: '\xF0\x9D\x84\x9E' (so this may be refused by the database insert if pagecode is utf8=utf8mb3) $newval = preg_replace('/[\x00-\x08\x0B-\x0C\x0E-\x1F\x7F]/u', '', $val); // /u operator makes UTF8 valid characters being ignored so are not included into the replace // Note that $newval may also be completely empty '' when non valid UTF8 are found.