preg_match() driving me bats

[bunner_bob]

I can't figure out why this is happening, but I have a preg_match() set up to allow alpha characters, hyphens, apostrophes, quotes, etc. But, it's not letting quotes and apostrophes (among other things) through. The input is a text (not textarea) field.

Here's the code:

if (!preg_match("/^[- \\\.\"\\\'\\\&\\\;()A-Za-z]{1,32}$/", $_POST['first']) || !preg_match("/^[- \\\.\"\\\'\\\&\\\;()A-Za-z]{1,32}$/", $_POST['last'])) {
    $result_msg['ERRORNAME'] = "Names can only contain letters, spaces, periods, quotes or the hyphen character!";
}

(note that I DO have the apostrophe escaped in my code - just doesn't show up here for some reason)
Any idea what's wrong?

• Bob

[jazz_snob]

Try putting your regexp in single quotes so PHP doesn't usurp the $ character

preg_match( '/^[a-z\ \'\".-]{1,32}$/i', $word )

I'm not sure if the above pattern includes all the characters you want to allow---you have some & and parenthesis in your original post.

[bunner_bob]

Still giving me trouble. I simplified the expression - or rather, I converted the submitted text to HTML before checking it, which took care of the double quotes (become &quot😉. But the single quotes are still hanging it up, whether I enclose the pattern in single quotes or double quotes.

The double quotes don't seem to cause a problem with the "$" - I used them around other patterns that worked just fine.

So right now I have

preg_match("/^[- .'&;A-Za-z]{1-32}$/", ConvertToHtml(stripslashes($_POST['firstname'])));

where ConvertToHtml does what it says.

I try echoing the input (complete with conversion and stripslashes) and it gives me what I'm putting in - "O'Connor" comes out "O'Connor". But it still is rejected by the preg_match.

I guess I could just match any character. I'm converting all input text to HTML anyway, so no risk of anyone sending in dangerous code. Seems like a copout though - I want to make this work.

Arrgh!

• Bob

[Installer]

If you're not committed to using a regular expression, this function should do the job:

function check_chars($str, $arr)
{
    for ($i = 0; $i < strlen($str); $i++) {
        if (!in_array($str{$i}, $arr)) {
            return false;
        }
    }
    return true;
}

$cap_ltrs = range('A', 'Z');
$sml_ltrs = range('a', 'z');
$nums = range('0', '9');
$symbols = array(' ', '.', '-', "'", '"');
$array = array_merge($cap_ltrs, $sml_ltrs, $nums, $symbols);

if (!check_chars($_POST['first'], $array) || !check_chars($_POST['last'], $array)) { 
    $result_msg['ERRORNAME'] = "Names can only contain letters, spaces, 
                                periods, quotes or the hyphen character!"; 
}
echo $result_msg['ERRORNAME'] . '<br />';

It might be more flexible, readable, and maintainable than a regular expression, but it would take up a few more bytes of script storage.

[jazz_snob]

FWIW, I couldn't match 'dash' characters unless the - was at the end of the char set, for example:

if( ereg( '^{[.][a-z0-9_.-]{1,63}$',} $v ) )
{
echo "<br />$v is OK";
}

narf. is OK
narf.gif.jpeg is OK
this_is.ok is OK
this-is-too is OK

when I had the - before the end of the char set, it wouldn't recognize dash characters in $v.

[bunner_bob]

Thanks Installer - finally got around to trying this and it works great.

One question - you say:

if(!in_array($str{$i},$arr))_{

• why the curly braces around $i? I thought with arrays you could just do $array[$key] (when $key is a variable) - the "$" automatically evaluates, and you don't need curly braces to force evaluation.

The function works for me with square brackets - am I just getting lucky? Should I be using curly braces?

• Bob

[rehfeld]

Originally posted by bunner bob

- why the curly braces around $i? I thought with arrays you could just do $array[$key] (when $key is a variable) - the "$" automatically evaluates, and you don't need curly braces to force evaluation.

• Bob [/B]

$str is not an array, its a string

you can access an individual char in a string that way. for example

$str = 'abc';

echo $str{0}; // a
echo $str{1}; // b

echo $str[1]; // b

you can [] as well as {}, but the manual recomends to only use {}.

using [] can be bad for readability because someone reading the code may think the variable is an array(like you did), when its really a string. so using {} makes it more clear your working on a string