Security and Regular Expressions

[klycette]

Depending on what field I'm validating, I'm using regular expressions to either make sure certain characters are present or not present. Could someone give me a good regular expression to protect against users entering code (angle brackets, etc) into my form fields? Also, how do you prevent users from entering blank spaces? Thanks.

[hi-liter]

here's some links to info on reg exp that i dug up when messing with reg exp's:

http://us4.php.net/pcre

http://www.phpfreaks.org/print.php?cmd=tutorial&tut_id=52

http://www.phpfreaks.org/print.php?cmd=tutorial&tut_id=63

http://phpbuilder.com/board/showthread.php?s=&threadid=10244000

hth.

EDIT:
OH! I see i already sent some links to your post back on 6/18
http://phpbuilder.com/board/showthread.php?s=&threadid=10244000
didn't realize it was same. guess they didn't help?

[laserlight]

I think the norm for protecting against angle brackets is to use htmlspecialchars() or strip_tags() rather than regex.
As for dealing with whitespace, it depends.
I suppose you would want to allow whitespace, not would not want extra whitespace in the middle or those in front/back.
Then, you could use trim() followed by $text = preg_replace("/[\r\n\t ]+/", " ", $text);

[klycette]

The links were a help; a guess part of what I'm looking for is a list of characters that I should be looking for to protect my site from being attacked. What should I look for? Angle brackets? What else?