PregQuoteUsedOnReplacement

warning native on by default quick-fix

Group: Probable bugs

Pattern escaping can insert unwanted characters into replacement text. Keep literal replacements separate from regex pattern escaping.

Example

Before

<?php
$s=preg_replace("/item/",preg_quote("a.b","/"),$text);

After fix

<?php
$s=preg_replace("/item/","a.b",$text);

Reported:

• line 2: Keep pattern escaping out of literal replacement text.

Detection

• Resolved preg_replace replacement argument is direct resolved preg_quote call whose literal input contains regex punctuation escaped by preg_quote but not replacement syntax. Highlight preg_quote call; dynamic values and dollar/backslash replacement semantics excluded.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

F1. Replace a direct preg_quote invocation in the replacement argument with the original literal input expression. The decoded literal must contain escaped regex punctuation but neither a dollar sign nor a backslash; the raw argument is a literal, all omitted delimiter evaluation is side-effect-free, and the invocation contains no comments. Preserve the input literal source bytes. Do not fix dynamic input, comment-bearing calls, or potential replacement-group syntax.

Comments introduced by # are comments too: suppress a fix whenever its replacement would discard them, just as for line and block comments.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "PregQuoteUsedOnReplacement": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore PregQuoteUsedOnReplacement