Sanitizing user inputs

Tea_J

What are your routines when saving user inputs (text Field) into a database and into a plain text file /xml?

I usually dont do anything because i want to preserve the exact inputs.. i sanitize HTML characters and other nasties during the display....

also, i have this text field were people tend to copy from a MS word document and paste em into the said field, which unfortunately includes the MS word special characters.. . It's pretty annoying...

What function is available for removing these MS word characters?

tea

devinemke

[man]trim[/man]
[man]strip_tags[/man]
[man]stripslashes[/man] (for display if magic_quotes is ON)
[man]addslashes[/man] (for db insertion if magic_quotes is OFF)
[man]htmlspecialchars[/man] (for display)
[man]str_replace[/man] (to strip out unwanted characters)

Tea_J

umm.. i know of all them functions dude.. but which is which for ms word sanitation?

Thanks

devinemke

umm...as i said before:
[man]str_replace[/man] (to strip out unwanted characters)

Tea_J

oh.. i see. but ..

1) what characters?? MS word special characters are hidden or is quite different from standard characters on my keyboard.

2) i reckon MS word has lots of these little nasties... using str_replace would mean having hundreds of str_replace lines... or i could do regular expressions.. but i wouldnt even know where to start..do you have a list of all the MS word hidden characters?

hmm.. i was hoping of some kind of function that would strip away everything but the regular strings

thanks

laserlight

i was hoping of some kind of function that would strip away everything but the regular strings

That's where regex comes in.
For example, let's say you only want to allow printable ASCII, i.e. from 0x20 to 0x7E, tabs, new lines and carriage returns.

$str = preg_replace('/[^\t\n\r\x20-\x7E]/', '', $str);

Of course, read the PHP Manual for the details.

Tea_J

thanks guys.. but like i said before, my bigger problem is "what characters" are to be targetted? MS Word has its own special characters <-- that's where my problem lies..

I was hoping for a function "specifically" for ms word hidden characters or atleast to strip away everything but standard letters.. the latter, i can perhaps solve with preg_replace..but it seems to be a longer way..

i juz thought there was a one line fuction for this.. something like stripslashes for stripping slashes..

Thanks guys.