Ticket #22286: backslashit-with-array-access.diff

tests/formatting/Slashit.php

@@ -4 +4 @@
  * @group formatting
  */
 class Tests_Formatting_Slashit extends WP_UnitTestCase {
+        function test_backslashes_middle_numbers() {
+                $this->assertEquals("\\a-!9\\a943\\b\\c", backslashit("a-!9a943bc"));
+        }
+
         function test_backslashes_alphas() {
                 $this->assertEquals("\\a943\\b\\c", backslashit("a943bc"));
         }

wordpress/wp-includes/formatting.php

@@ -1342 +1342 @@
  * @return string String with backslashes inserted.
  */
 function backslashit($string) {
-        $string = preg_replace('/^([0-9])/', '\\\\\\\\\1', $string);
-        $string = preg_replace('/([a-z])/i', '\\\\\1', $string);
+        // string literals are chosen instead of 0x30..0x39 as value selected
+        // from string is more likely to be string, than integer, thus casted
+        // PHP form shall take place
+        if ( isset( $string[0] ) && $string[0] >= '0' && $string[0] <= '9' ) {
+                $string = '\\\\' . $string;
+        }
+        // Do not use [A..z], as it would also add backslashes to intermediate
+        // characters (namely: '[', '\', ']', '^', '_', '`').
+        $string = addcslashes(
+                $string,
+                'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
+        );
         return $string;
 }