class security: changed /e into preg_replace_callback()