regex - PHP - Is this a safe way to allow user-supplied regular expressions -

I would like to permit the submission of a small user-defined regular expression for testing, however, more evil than run-over server usage < There are several problems to consider code> eval () usage.

For my knowledge, I have handled those problems which I could think of following code, do not I have thought of any attack vectors? (I know one but not innocuous question)

  function testRegex ($ regex) {// Null Character allows a premature regenerative end and "/../e" injection if ( SRPO ($ regex, 0)! == incorrect ||! Trim ($ regex)) {return false; } $ Backtrack_limit = ini_set ('pcre.backtrack_limit', 200); $ Recursion_limit = ini_set ('pcre.recursion_limit', 20); $ Valid = @ peg_match ("~ $ regex ~ u", tap)! == Incorrect; Ini_set ('pcre.backtrack_limit', $ backtrack_limit); Ini_set ('pcre.recursion_limit', $ recursion_limit); Return valid $; } $ Regexes = array ("Invalid Regular Expression"), '', '\ w +', '\ / \ w + /', 'foo [bar] *', '\ / \ x00known / e' Chr (0x00 ) Chr (0), 'known' e 'chr (0),' known 'e' chr (0x00), '[az] +', '\ p {lu} +',); Forex Currency ($ regexes as $ regex) {var_dump ($ regex, testRegex ($ regex)); }  

If you want to see an example of the injection of null-bite :

  $ user_regex = ' E 'chr (0); $ User_match = 'System ("Hummy")'; Var_dump (preg_replace ("~ $ user_regex ~ u", $ user_match, 'foo'));  
 
 Obviously, this is the only way to check that the string is a valid regular expression Compiling (which you call on any mailing function) is done, then what you're doing makes a lot of emotions. 
 
 The blank-byte security you added is not really necessary  since 5.4 , because already checked, and especially to fix the latter Is a relatively recent (2011). 
 
 Setting a low backcrack and recursion range is a good enough sandbox, maybe you can also check for the maximum length. 
 
 He said, the ability to use the special solutions such as  / s ,  / i  and  / m  does not provide; Maybe he is not your main concern at this time, but it is food for thought :)