{"action":"opened","issue":{"url":"https://api.github.com/repos/chuyskywalker/phpaes/issues/5","labels_url":"https://api.github.com/repos/chuyskywalker/phpaes/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/chuyskywalker/phpaes/issues/5/comments","events_url":"https://api.github.com/repos/chuyskywalker/phpaes/issues/5/events","html_url":"https://github.com/chuyskywalker/phpaes/issues/5","id":89016176,"number":5,"title":"Potential problem using strlen()","user":{"login":"Darkheir","id":679995,"avatar_url":"https://avatars.githubusercontent.com/u/679995?v=3","gravatar_id":"","url":"https://api.github.com/users/Darkheir","html_url":"https://github.com/Darkheir","followers_url":"https://api.github.com/users/Darkheir/followers","following_url":"https://api.github.com/users/Darkheir/following{/other_user}","gists_url":"https://api.github.com/users/Darkheir/gists{/gist_id}","starred_url":"https://api.github.com/users/Darkheir/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Darkheir/subscriptions","organizations_url":"https://api.github.com/users/Darkheir/orgs","repos_url":"https://api.github.com/users/Darkheir/repos","events_url":"https://api.github.com/users/Darkheir/events{/privacy}","received_events_url":"https://api.github.com/users/Darkheir/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-06-17T13:26:28Z","updated_at":"2015-06-17T13:26:28Z","closed_at":null,"body":"In the code you are using `strlen()` to get length size of a string in multiple places.\r\n\r\nIn most cases this function will work fine and return the byte size of the string (that's what we need when performing encryption)\r\n\r\nbut if in the php.ini file we setted  `mbstring.func_overload` then the method mb_strlen()` will be used instead of the classic `strlen()` and this method by default count the number of characters.\r\n\r\nSince an UTF-8 character can take up to 4 bytes the number of characters and the number of bytes can be different.\r\n\r\n```php\r\n$foo = \"bär\";\r\necho strlen($foo); //Will print 4\r\necho mb_strlen($foo); //Will print 3\r\n```\r\n\r\nTo avoid this kind of problem a custom method to determine the string length should be implemented.\r\n\r\nHere's an example from another project:\r\n\r\n```php\r\nprivate static function ourStrlen($str) {\r\n    static $exists = null;\r\n    if ($exists === null) {\r\n        $exists = \\function_exists('mb_strlen');\r\n    }\r\n    if ($exists) {\r\n        $length = \\mb_strlen($str, '8bit');\r\n        if ($length === FALSE) {\r\n            throw new Ex\\CannotPerformOperation();\r\n        }\r\n        return $length;\r\n    } else {\r\n        return \\strlen($str);\r\n    }\r\n}\r\n```\r\n"}}