parse_ini_*(): Add warning that the functions are unsafe with untrusted inputs (#4946)

Author: TimWolla

reference/filesystem/functions/parse-ini-file.xml

@@ -22,6 +22,14 @@
   <para>
    The structure of the ini file is the same as the &php.ini;'s.
   </para>
+  <warning>
+   <simpara>
+    This function must not be used with untrusted inputs, unless
+    <parameter>scanner_mode</parameter> is <constant>INI_SCANNER_RAW</constant>
+    since the parsed output might contain the values of sensitive
+    constants, such as constants holding a database password.
+   </simpara>
+  </warning>
  </refsect1>
 
  <refsect1 role="parameters">

reference/filesystem/functions/parse-ini-string.xml

@@ -21,6 +21,14 @@
   <para>
    The structure of the ini string is the same as the &php.ini;'s.
   </para>
+  <warning>
+   <simpara>
+    This function must not be used with untrusted inputs, unless
+    <parameter>scanner_mode</parameter> is <constant>INI_SCANNER_RAW</constant>
+    since the parsed output might contain the values of sensitive
+    constants, such as constants holding a database password.
+   </simpara>
+  </warning>
  </refsect1>
 
  <refsect1 role="parameters">