ereg_replace problem

[Anon]

I've got a domain auction site, and I'm trying to strip out any characters from the user input that will break my SQL statements... but some don't seem to be working.

i.e.

function b_strip($bid)
{
$bid = ereg_replace( "(,)(')", "", $bid);
}

won't let my sql statement add a bid to a table...

I can get something like

$desc = ereg_replace( "'", "\'", $desc);

to work. Is my syntax wrong for removing more than one char?

Thanks,

Bob

[Anon]

Ok, I'm getting somewhere, but I just don't get why:

ereg_replace("[^{([:digit:][=.=])]",} "", $string);

or

ereg_replace( "[^0-9.]", "", $string);

strips everying after the first char it strips. i.e., enter 4,000 and it returns 4??

(inserting supposedly stripped data into mysql and then selecting for display)

Bob

PS I am doing .addslashes($string). in my SQL statements..

[Anon]

Maybe my problem is that the HTML form is turning my commas into %2C... but even a ereg_replace of that string will cut off anything after(and including) the comma for a number.

[Anon]

Why not make things simple.

To begin with, why do you want to replace , commas with ,_ comma-space?? Not necessary in SQL, right?

Write the whole SQL statement with userinputs use of ' apostrofies.
These will have to be replaced with '' double-apostrofies.

Instead of ereg_replace all elements before use this function:

function strip_apos($q) {
$q = str_replace("'","''",$q);

$q = str_replace("(''","('",$q);
$q = str_replace("'')","')",$q);
$q = str_replace("'',","',",$q);
$q = str_replace(",''",",'",$q);

return $q;

}

$sql = "INSERT INTO table(name, address) VALUES('Peter'','Be'ngtsson')";

$sql = strip_apos($sql);

Returns $sql like this:
$sql = "INSERT INTO table(name, address) VALUES('Peter''','Be''ngtsson')";

Look closely at the function and understand what it does. Quite simple acctually.
Please report if I causes you an error.

[Anon]

but isn't

ereg_replace("'", "", $string);

going to replace ' with nothing..? Can you point out in the manual where it details how to use the ()'s?

Bob

[Anon]

But why do you want to replace ' apos with nothing.

If somebody inputs his name which is "Mac'Donalds". You are going to change his name if you replace ' apos with nothing.
Unfair to Mr. Mac'Donalds.

[Anon]

Hi, sorry for the delay - I was away on my honeymoon!

I'm still having problems with the apos.

I've tried to run:

INSERT INTO user(first, last) VALUES('Peter''','Be''ngtsson');

as your strip_apos() function would do, but it's just not working.

I am inputing the INSERT query into phpMyAdmin but I'm getting the error:

-MySQL said: You have an error in your SQL syntax near 'user(first, last) VALUES('Peter''','Be''ngtsson')' at line 1-

What I don't understand, is I am getting a similar error message, if I just try to escape the apos with a backslash? MySQL gives me:

MySQL said: You have an error in your SQL syntax near 'user(first, last) VALUES('Peter','Be'ngtsson');' at line 1