title: PHP str_replace bypass
body: <p>I have concerns about the safe use of the function <code>str_replace</code>. 
  E.G.</p>
  
  <pre><code>$var = "abcdeefghij";
  $var = str_replace("ee", "", $var); // Should be "abcdfghij"
  </code></pre>
  
  <p>Is it possible to bypass (get "abcdeefghij" - with 2 'e' letters) this by multibyte charset or null character for example?</p>
  
  <p>EDIT:
  I was thinking about something like this: abcd%6565fghij %6565 would be replaced by ee but <code>str_replace</code> wouldnt work because it is multibyte string (<code>mb_str_replace</code>).</p>