All rules →
Rules / PHP
SHIELD-PHP-006

Code injection via preg_replace /e modifier

criticalPHPCWE-95CVSS 9.8

What it detects

preg_replace with the deprecated /e modifier evaluates the replacement as PHP code.

How to fix

Replace the /e modifier with preg_replace_callback.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-006: Code injection via preg_replace /e modifier — Zennoxa Shield