Posix Regex

ID

php.posix_regex

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Php

Tags

deprecated-api, reliability

Description

Reports calls to the POSIX (ext/ereg) regular-expression functions: ereg, eregi, ereg_replace, eregi_replace, split, spliti and sql_regcase. These functions are the scope of this rule; the general deprecated-function check intentionally leaves the POSIX family to this dedicated rule.

Rationale

The entire POSIX regex extension was deprecated in PHP 5.3 and removed in PHP 7.0. Calling any of these functions on a modern runtime raises a fatal "call to undefined function" error, so the code simply stops working. POSIX regex syntax also differs from PCRE, and the split family was slower and quietly returned false on malformed patterns, which hid bugs.

<?php
function tokens(string $input): array
{
    if (ereg('^[0-9]+$', $input)) {     // FLAW — ereg removed in PHP 7
        return [];
    }
    return split(',', $input);          // FLAW — split removed in PHP 7

    // OK — PCRE replacements
    // preg_match('/^[0-9]+$/', $input);
    // explode(',', $input);
}

Remediation

Replace the POSIX calls with their PCRE (preg_*) equivalents: ereg / eregi become preg_match (add the i flag for the case-insensitive variant), ereg_replace / eregi_replace become preg_replace, and split / spliti become preg_split or, for a plain string delimiter, explode. Remember that PCRE patterns must be wrapped in delimiters (for example '/…​/').

References