Pattern recognition

[thewump]

Hello all,

I'm new to PHP and a complete newbie with this style of pattern recognition.

Can someone suggest a way that I can strip a valid IP out of a random string?

e.g.

$str="this contains 192.168.1.1 and [101 other numbers] some incomplete like 192.168.x"

I'm trying to strip IP addresses out of Received: tags in email headers.

Thanks in advance.. I'll watch and learn ;-)

Keith

[bretticus]

Read up on pattern syntax and you will understand this better but...

the pattern you need is

/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/

which is basically saying, "look for 0-9 from 1 to 3 times, then look for a dot." Then we just repeat the pattern 3 more times (all four octets of an ip address.) If you are sure the ip address will not come as the first or last "word" in your string to search you can stipulate a word boundary before and after for a more fool-proof result like

/\b[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\b/

Cheers!

[thewump]

Thanks.. I got that to work, but in a convoluted way..

I'm thinking that preg_grep is the way to pull the pattern OUT of the string, right? I can't figure how it wants the string to be passed to it.. I know it wants an array - but I don't get it.

As a work around, I've got the result I need by using preg_split and then str_replacing each of the returned array elements out of the original string.. Clunky ;-)

Best

Keith

[NogDog]

You could use preg_match_all() to pull out all of the IP addresses into an array, then use preg_replace() to remove them from the string.

[thewump]

Firstly, I'm amazed at the speed of responses on this board!

Secondly, that's looking more healthy in terms of number of lines of code ;-)

Sample:

ip_string = "Recieved From: from 201.58.87.999 ([201.58.87.999]) by 20158091116.user.XXXXXX.com.br with Microsoft SMTPSVC(6.0.3790.0); Wed, 15 Nov 2006 01:48:34 -0300 ";
preg_match_all("/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/", $ip_string, $ip);
echo $ip[0][0];

For my needs, I'm seeing that there MIGHT be two IPs in the string, but they are both the same.. so pulling the first one is fine.

Best

Keith
PS.. just out of interest if I publish an email address [e-mail] here, how long does it take to get $pam-med? I'll let you know.. I'm disgusted by the amount of work that is going into a new project just to protect it from sp@mm.. it's ridiculous.