Zennoxa Shield
Rules / PHP
SHIELD-PHP-006

Code injection via preg_replace /e modifier

criticalPHPCWE-95CVSS 9.8

What it detects

preg_replace with the deprecated /e modifier evaluates the replacement as PHP code.

How to fix

Replace the /e modifier with preg_replace_callback.

Vulnerable — Shield flags thisbbcode.php
<?php
// BBCode formatter — vulnerable: /e evaluates the replacement as PHP code
function renderBold(string $text): string {
    return preg_replace('/\[b\](.*?)\[\/b\]/e', "'<b>' . strtoupper('\\1') . '</b>'", $text);
}
Fixed — scans cleanbbcode.php
<?php
// preg_replace_callback runs a real closure — nothing is eval'd from a string
function renderBold(string $text): string {
    return preg_replace_callback('/\[b\](.*?)\[\/b\]/', function ($m) {
        return '<b>' . strtoupper($m[1]) . '</b>';
    }, $text);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-006, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-006: Code injection via preg_replace /e modifier — Zennoxa Shield