Hacker News Reader

Comment by 0x0 | Hacker News Reader

I wonder what kind of security vulnerabilities could be looming in validators not expecting non-ascii 0-9 digits and using this regex?

View on HN

I'm betting quite a few. People should use library number parsers, even if they reject all non-[0-9].

That's exactly what I was thinking!

As of PHP 5.3, PHP-powered software is safe. Using

    is_numeric('١٣٦٨') // -> false
    preg_match('/\d/', '١٣٦٨') // -> no match / false
    filter_var('١٣٦٨', FILTER_VALIDATE_INT) // -> false

Which I'm thankful for. I should hope that most people understand base-10 and ascii numbers. I don't want to have to worry about properly validating/handling unicode characters with number parsing.

In PHP 5.4.15, I get:

  var_dump(preg_match('/\d/u', '١٣٦٨')) -> 1
  var_dump(preg_match('/\d/', '١٣٦٨'))  -> 0

Reply on news.ycombinator.com