ereg headache

[hawleyj]

I'm trying to filter out illegal characters from a password submission by using ereg() but I'm stuck. Let's say I want to filter out

,.*+#'

Does anyone out there know what I need to do to write a correct ereg statement to catch all that in a password submission?

Thanks in advance.

Jim Hawley

[Anon]

You actually don't need to use ereg for this task.
I would solve this by using str_replace instead, wich is much faster.
$text = str_replace(",","",$text);
$text = str_replace("*","",$text);
...
/christian

[hawleyj]

I wish I could, but...

I am allowing users to register and give their own passwords. They do the normal thing, put it in and then do it again to confirm it. I have checks for the confirmation in both JavaScript and php just in case they have JavaScript turned off. But I need to check to make sure they didn't put in any bad characters, I can catch it in JavaScript, but like before, what if they have JavaScript turned off. I don't want to replace anything for them, if they enter bad characters I want to let them know that the characters were bad and let them try again.

Thanks,

Jim

[rdhatt]

I prefer the PCRE's, and this how I'd do it:

if(preg_match("/[,.*+#']/", $password))
register(); // password has illegal char, redo register

[yelvington]

You want to test for the existence of any of a class of characters.

A class of characters in a regular expression is called a "bracket expression" and it looks like this:

[egbdf]

That bracket expression lists five letters, any of which may appear. To make a regular expression that says "match if there is one or more from this set," you add a plus sign:

[egbdf]+

Because you want to include an apostrophe in your character class, we have to be careful in constructing the character string that is passed to ereg() or ereg_replace(). We have

'[,.+#\']+'
or
"[,.+#']+"

Either will work. In the first example, the ' is escaped by a backslash. The function never sees this, as it is "eaten" by PHP.

Try this:

if (ereg("[,.*+#']+",'I am I am')) echo "yes<BR>"; else echo "no<BR>";

It should print "no<BR>".

If you change "I am I am" to "I am, I am" it will print "yes<BR>".

There also are special character classes in regular expressions that you might find useful, such as

[:alnum:] which is shorthand for "any alpha or numeric character," and

[b-g] which means "any letter between b and g, inclusive.

And you can negate a class by using a caret as its first element:

[^:alnum:] or [^abdef] or [^m-z]

[vsego]

If you use ereg("^{[,.+#']{6,8}$",...)} instead of ereg("[,.+#']+",...), you'll have length checked as well. :-)