Kjartan Mannes

I have been doing quite a bit of PHP coding again lately, and one of the things I have been playing with has been the preg_replace() function. Specifically the /e modifier. What doesn't seem to be documented anywhere, except in a few bug reports, is that when using the /e modifier PHP will automatically perform an addslashes() on the backreferences. No big deal, I figured, just add a stripslashes() to get the original value. That seemed to work ok so the code I am working on goes into production, but a few days later I get reports of mangled data. Things that were being put in weren't coming back out again exactly the same.
Being a good developers and using CVS I check the commits that have been performed in the last week. None of the changes seem to interact with input data, except the preg_replace() code. I get a hold of sample input data that is modified and notice it includes a lot of slashes, quotes and other weird symbols. Removing the preg_replace() call fixes the problem so time to do some digging.
A few minutes later I have a test script that shows the root cause of the problem:

[kjartan@hydra scripts]$ ./preg_replace
Original     => 'single: ' quote: " slash: \'
addslashes   => 'single: \' quote: \" slash: \\'
stripslashes => 'single: ' quote: " slash: \'

Original     => 'single: ' quote: " slash: \'
preg_replace => 'single: \' quote: " slash: \'
stripslashes => 'single: ' quote: " slash: '

If you look closely you will spot that preg_replace()'s way of adding slashes doesn't match the way addslashes() does it. This results in in the single slash from the original being removed. After playing around a little more with different combinations and checking the preg_replace() C source, I figure out what is going on. preg_replace() only adds slashes to the quote that matches the quotes surrounding the replacement parameter.
What I have ended up doing is using str_replace("\\'", "'", $string) instead of stripslashes($string), assuming of course the replacement is quoted in 's. If using "s just change the str_replace() to change from \"s to "s.
Now to get the documentation on php.net updated. Maybe I should just add a comment.