Merge pull request #6 from jecknig/master

Correctly escape strings for use in executed code

Author: fieryprophet

src/PHPSandbox.php

@@ -6484,7 +6484,7 @@ protected function prepareVars(){
                     } else if(is_float($value)){
                         $output[] = '$' . $name . ' = ' . ($value ? $value : '0.0');
                     } else if(is_string($value)){
-                        $output[] = '$' . $name . " = '" . addcslashes($value, "'") . "'";
+                        $output[] = '$' . $name . " = '" . addcslashes($value, "'\\") . "'";
                     } else {
                         $output[] = '$' . $name . " = null";
                     }
@@ -6508,7 +6508,7 @@ protected function prepareConsts(){
                     } else if(is_float($value)){
                         $output[] = '\define(' . "'" . $name . "', " . ($value ? $value : '0.0') . ');';
                     } else if(is_string($value)){
-                        $output[] = '\define(' . "'" . $name . "', '" . addcslashes($value, "'") . "');";
+                        $output[] = '\define(' . "'" . $name . "', '" . addcslashes($value, "'\\") . "');";
                     } else {
                         $output[] = '\define(' . "'" . $name . "', null);";
                     }
@@ -7123,4 +7123,4 @@ public function __call($method, $arguments){
             trigger_error('Fatal error: Call to undefined method PHPSandbox::' . $method, E_ERROR);
             return null;
         }
-    }
+    }