[RESOLVED] PHP preg_match and create_function

rr1024

Hello all and thanks for reading my question.

I have a country list in MySQL database which is part of a geo location system with zipcodes etc..

I would like to validate zipcode formats for each country and store the core of the format validation in MySql cell called valid_zip which will be in the countries data base. Like this, example using USA zipcode match
ID, Country_Name, Valid_Zip
1 , USA,

Valid_Zip Cell would have the following php code

IF ( !preg_match( '/^[0-9]{5}$/', $CheckZipCode ) ) RETURN '_ZIP_INVALID_USA'; ELSE RETURN '';

Problem is SQL doesn't like the ' single quote thing, can i just add slashes to it?

Now when I do my query for example I would do something like this

        $GeoCountryArr = dbArr("SELECT * FROM `GeoCountries` WHERE ID = {$GeoIdArr['ID']} OR `Country_ID` = {$GeoIdArr['Country_ID']}");
        IF ( !EMPTY( $GeoCountryArr['Valid_Zip'] ) ) {
             $funcbody = $GeoCountryArr['Valid_Zip'];
             $func = create_function( "", $funcbody );
             $MsgErrZip = $func();
        }ELSE{
             do something else etc..
        }
            RETURN $MsgErrZip;

It seems the easiest and best way to handle this sort of thing at least as far as i can think of.

I don't want to have to create a huge list of 240 IF's or SWITCH CASE to handle this unless it is the only way.

bubblenut

Extract what changes. In this case the only thing which really changes is the regular expression, so why don't you just store that in table.

$GeoCountryArr = dbArr( "SELECT * FROM `GeoCountries` WHERE ID = {$GeoIdArr['ID']} OR `Country_ID` = {$GeoIdArr['Country_ID']}");
if( !empty( $GeoCountryArr['Valid_Zip'] ) ) {
    if( !preg_match( $GeoCountryArr['Valid_Zip'], $CheckZipCode ) ) {
        $MsgErrZip = 'Invalid Zipcode';
    }// ...

NogDog

I would just store the regex in the DB, then use it as needed.

Insert regex into DB

$regex = '/^\d{5}(-\d{4})?$/';  // use single quotes so you don't lose back-slashes
$sql = "INSERT INTO `GeoCountries` (`ID`, `Country_Name`, `Valid_Zip`) " .
       "VALUES ('USA', '" . mysql_real_escape_string($regex) . "'";
// do the db query using this SQL...

Use it:

$GeoCountryArr = dbArr("SELECT * FROM `GeoCountries` WHERE ID = {$GeoIdArr['ID']} OR `Country_ID` = {$GeoIdArr['Country_ID']}");
IF ( !EMPTY( $GeoCountryArr['Valid_Zip'] ) ) {
   if(!preg_match($GeoIdArr['Valid_Zip'], $zipCodeBeingChecked))
   {
      // Invalid zip code
   }
}

rr1024

Both of those are Great Idea's thanks, i'll give both a try this evening.

Now the big question is does either of you know a good web reference for creating / modifing regular expression something like an idoits guide ....lol

Thanks Much

bradgrafelman

I've really enjoyed using this site when I need to lookup something about regexp.

They have a tutorial as well as examples of how to use regular expression.

rr1024

Hello I've tried to put the Regex in the table and pulled it like this

      $MsgErrZip = FALSE;

    $Sql = "SELECT
                     `Zip_Regex`, `Zip_Msg`
                FROM
                     `GeoCountries`
                WHERE
                     `Country_ID` = {$GeoCountryID}";
    $GeoCountryArr = dbArr( $Sql, 0 );
    IF ( !EMPTY( $GeoCountryArr['Zip_Regex'] ) ) {
         //$Regex = "'".$GeoCountryArr['Zip_Regex']."'";
         $Regex = stripslashes( $GeoCountryArr['Zip_Regex'] );
         //$Regex = str_replace('\\', "", $Regex);
         echo $Regex;
         IF ( !preg_match( $Regex, $CheckZipCode ) ) {
              $MsgErrZip = $GeoCountryArr['Zip_Msg'];
         }
    }               
    # \'/^[0-9]{5}$/\' in data base using mysql_real_escape_string() during insert
    #  '/^[0-9]{5}$/' after strip slashes 
    # Working version IF ( !preg_match( '/^[0-9]{5}$/', $CheckZipCode ) )
    RETURN $MsgErrZip;

The problem is it always returns a failed or invalid zip code even when the zip code is valid
example 94550 fails, 99 fails, dd fails

So is there something I'm doing wrong?

bradgrafelman

rr1024 wrote:
# \'/^[0-9]{5}$/\' in data base using mysql_real_escape_string() during insert

This means that magic_quotes_gpc is enabled - you should disable this right away. Then, remove the stripslashes() from your code.

Secondly... why are there quotes surrounding your regexp pattern? There shouldn't be. Fix that, and you'll fix your problem.

NogDog

You shouldn't have to stripslashes() anything that you're taking out of the database. Also, you don't need the quotes around the regex, as they'll be used as the regex delimiter instead of the "/" character if you do. So the insert should be something like:

$regex = mysql_real_escape_string('/^[0-9]{5}$/');  // escaping probably not really needed in this case, but it won't hurt
$query = "INSERT INTO table_name (col1, col2, regex) VALUES ('foo', 'bar', '$regex')";
mysql_query($query) or die(mysql_error());

(The escape characters that mysql_real_escape_string() adds do not actually get saved in the database, they just make sure that the SQL parser treats the characters that they escape as their literal values and not as whatever "special" meaning they might otherwise have in SQL.)

Then when you retrieve the regex from the DB, just use the value as retrieved without modification of any sort (i.e.: no stripslashes(), no quotes around it, etc.):

$regex = $GeoCountryArr['Zip_Regex'];
if(!preg_match($regex, $CheckZipCode)) {

rr1024

Thanks Bradgrafelman
I don't think I can turn off magic_quotes_gpc since I'm on a shared server I did get it

functioning by doing this
        IF ( !EMPTY( $GeoCountryArr['Zip_Regex'] ) ) {
             //$Regex = "'".$GeoCountryArr['Zip_Regex']."'";
             $Regex = stripslashes( $GeoCountryArr['Zip_Regex'] );
             $Regex = str_replace('\'', "", $Regex);
             echo $Regex;
             echo " zip= ".$CheckZipCode;
             IF ( !preg_match( $Regex, $CheckZipCode ) ) {
                  $MsgErrZip = $GeoCountryArr['Zip_Msg'];
             }
        }

However, I'm wondering if I remove

mysql_real_escape_string($regex)

from the input and when I add a new regex code I can just add it without the single quotes

Then I can remove the strip slash and str replace right? or are there chars that I need to use that still need mysql_real_escape

rr1024

Well that seem to work too, what I said above.....however I don't know if there are any draw backs to doing it without the mysql_real_escape_string($regex)

Is there draw backs or some problem doing it this way i.e.
removing
mysql_real_escape_string($regex) from the input form

Then removing strip slash and str replace in the validating function?

bradgrafelman

If PHP is installed as an Apache module instead as a CGI binary (phpinfo() will tell you this), you should be able to put this in a .htaccess file in the root of your site:

php_flag magic_quotes_gpc Off

rr1024

Great thanks much