Regular Expression (regex) or operator "|" It is easy to use Function Bug, regexbug

Regular Expression (regex) or operator "|" It is easy to use Function Bug, regexbug

Last article: Regular Expressions (regex) are incorrectly used, leading to function vulnerabilities. We will continue to sort out this article. Regular Expressions are incorrectly used, leading to functional design vulnerabilities (bugs) and web applications, A lot of knowledge is required. The website development work has been in China for more than 10 years. Many developers use the process of training (self-learning)-> imitating-> Project Creation. Many of them become web development engineers after repair and modification. This line is easy to get started. However, it is not easy to become a master. You need to learn and master dozens of courses. For beginners, many people often lack systematic learning and theoretical support. As a result, there is a lack of effort to improve! Therefore, these more or less functional design vulnerabilities are very common!

Well, there are some problems. This type of vulnerability often occurs during code lookup. Let's take a look at the following code:

<? Php $ user = "bcd123 zhangsan"; // The matched username starts with abc and bcd, followed by the digit preg_match_all ("/abc | bcd \ d + /", $ user, $ match); var_dump ($ match);/* The result is array (1) {[0] => array (1) {[0] => string (6) "bcd123 "}}*/

Search for all pages that start with abc or bcd, followed by a numeric string. Through the above, we can see that bcd123 is correctly matched. If we enter $ user = "abc123 zhangsan", we will find that it cannot be matched. The reason is that the character "|" has the lowest priority. The above writing method will be: Match abc or bcd \ d + String.

To include | in.

To increase the priority, you can (abc | bcd) \ d + to match all abc or bcd strings followed by digits. When using the "|" string, note that its priority level is low. If you want to prioritize matching, you can put it in.