| Don't use /e with untrusted input This isn't a case of someone running: preg_replace($VAR1 + "/e", $VAR2,''); No one passed untrusted input to '/e.' It's

| Don't use /e with untrusted input This isn't a case of someone running: preg_replace($VAR1 + "/e", $VAR2,''); No one passed untrusted input to '/e.' It's a case of untrusted input being passed to preg_replace() in an insecure way, which allowed '/e' to be enabled. All of this is sort of irrelevant anyways. The developers did not add the preg_replace() function, the attacker did so as a way to eval code without directly calling eval() (which would be easy to spot in the code, since it should so rarely be called in practice).