you should keep $options as the first argument. Otherwise, this will break the XML and YAML loaders, which only pass a single argument with all options. Named arguments for all available options must come after it.

OK thanks.

All those groups should be non-capturing, to avoid reaching the limit on the number of capturing groups in PCRE

the brackets should just be removed actually

Unfortunately, the behaviour is not the same with [] instead of ().
As an example, "$yMph0NY" is not detected because of "ph". Same if I change "symfony" into "symfohny". It looks like multicharacters are not understood when grouping with []

I asked to use non-capturing groups, not character classes

what about all characters that are not keys in self::LEET_MAP (which include uppercase letters btw, as you don't enforce lowercase in the dictionary) ? Having a . in the dictionary would lead to pretty bad things (it gets even worse when you consider that anything else than a lowercase ASCII letter is injected as is in the regex, allowing to inject all regex special chars in it)

For uppercase, I use the modifier i. You are right, the dictionary shall only contain lowercase alpha otherwize it does not work.

The strtr does not care that you use the i modifier in the final regex: it won't turn a A in the dictionary word into l33t equivalents

You are right, the dictionary shall only contain lowercase alpha otherwize it does not work.

This must be enforced, because it opens the door to bad behavior otherwise (and it is actually a nasty requirement as it would also add that requirement for the non-l33t banned words, which don't have this restriction otherwise)