only allow commond character

[Deimos]

I know this is a really stupid question, but I'm a real newbie at PHP (like less than 2 weeks).

What I need to know is a simple (simple mind you) way, if there is one, to ensure that form only contains a-z, A-Z, 0-9, @, or . characters.

I have done a search on these forums, but I'm afraid that I don't really understand quite what I'm getting as a result.

I had thought about using str_replace or preg_replace, but I'm not quite sure how the functionality would work....

I'd like to have it assumed that the fields to check are named in the form as
username
email

$a = $REQUEST['username'];
$b = $REQUEST['email'];

If you could be of any assistance in this I'd certainly appreciate you for helping an admittedly clueless newbie.

Thanks....

[Deimos]

Do I really need to worry about any characters other than < and > for html and script tags?

If not...then the str_replace will work fine....

I'm just concerned about security

[Deimos]

is there not a way to do this?

surely I don't have to do a replace for every character I don't want in the string........

anyone?

I'm only concerned with characters that can cause problems..

[hand]

You can convert your output using htmlspecialchars ()
http://www.php3.de/manual/en/function.htmlspecialchars.php

[br__ken]

learn regular expressions 🙂 they look like jibberish at first, but if you play around with them, youll get the hang of it fairly quick

a few examples

$text="<script>bad code</script>";
$text=preg_replace("/\</","&lt;",$text);
echo $text;
// view the source to see &lt;script>bad code&lt;/script>

$text="<script>bad code</script>";
$text=htmlspecialchars($text);
// view source to see &lt;script&gt;bad code&lt;/script&gt;

// to validate an email (guessing since you only want @,.,a-z,0-9
if(ereg("^.+@.+\\..+$" , $email))

// i use that, its pretty weak- but it gets it 'almost' right
// eventho "[e-mail]" would pass =)

[SpasePeepole]

^{([_a-zA-Z0-9-])@([a-zA-Z0-9-]).([a-zA-Z0-9])}

blah

[Deimos]

just wanted to say thanks to all of you who responded to help me out.

It is greatly appreciated...and it's working now.

I ended up using the preg_replace to suit my needs. Seems to work just fine so far.