== How to fix it in Core PHP

=== Code examples

The following noncompliant code is vulnerable to Regex Denial of Service (ReDoS)
because untrusted data is used as a regex to scan a string without prior
sanitization or validation.

==== Noncompliant code example

[source,php,diff-id=1,diff-type=noncompliant]
----
function lookup(string $data): bool {
  $regex = $_GET["regex"];
  return preg_match($regex, $data); // Noncompliant
}
----

==== Compliant solution

[source,php,diff-id=1,diff-type=compliant]
----
function lookup(string $data): bool {
  $regex = $_GET["regex"];
  return preg_match(preg_quote($regex), $data);
}
----

=== How does this work?

include::../../common/fix/validation.adoc[]

In the compliant solution, `preg_quote` escapes metacharacters and escape sequences that
could have broken the initially intended logic.
