[RESOLVED] ereg_replace question

[vexx]

I have the following lines of code:

$title =ereg_replace("[^[:alnum:]]", " ", $_POST['title']);
$title = ereg_replace(" +",' ',$title);

Any inputed title will be shown, except for the special chars. My question is, how can I allow the following chars: ' and -

Tnx

[kakki]

because "+" has a special meaning, you'll need to escape that either with
\
or sth like this

$title = ereg_replace(" [+']",' ',$title);

[vexx]

i'm not sure I understood that, can you give me an example with the chars ' and - ? I'm a newbie programmer, so bare with me 🙂 Basically, I don't want to change anything but to allow the ' and - chars there..that's all

tnx

[laserlight]

In the first place, prefer [man]preg_replace/man to ereg_replace().

While kakki has a point, it does not apply in this case. I believe the second replacement actually is correct and is intended to replace multiple consecutive spaces with a single space.

I would suggest:

$title = preg_replace('/[^\w\'-]/', '', $_POST['title']);
$title = preg_replace('/ +/', ' ', $title);

The first line replaces all non-"word" characters (generally alphanumeric characters) besides the single quote and dash with a blank. The second line replaces multiple consecutive spaces with a single space.

For more information, read the PHP manual on [man]PCRE[/man].

[vexx]

i replaced the code with the one provided by you and unfortunately it doesn't work if I enter the char ' within the title

[laserlight]

i replaced the code with the one provided by you and unfortunately it doesn't work if I enter the char ' within the title

I gave it a quick test, and it seems to work. How does it not work? Any example?

EDIT:
Oh, I discovered a bug, though it is not related to your problem. When replacing with blanks, the lines should be swapped:

$title = preg_replace('/ +/', ' ', $_POST['title']);
$title = preg_replace('/[^\w\'-]/', '', $title);

Otherwise all the spaces get taken out to begin with.

[vexx]

well, my site works like this, I add a manual title, the site displays it along with it's description. When I input a title with the ' char within, the site doesn't display anything. If I add a title with the - char within, it works with no problem

[laserlight]

well, my site works like this, I add a manual title, the site displays it along with it's description. When I input a title with the ' char within, the site doesn't display anything. If I add a title with the - char within, it works with no problem

That's rather strange.

Anyway, I misunderstood the problem earlier. Swapping does not work, since eventually the spaces will get removed anyway. Rather, the original requirement was not precisely stated: you only want to allow alphanumeric characters, dashes, single quotes and spaces, with multiple consecutive spaces reduced to one space. Therefore, I suggest that you test with:

<?php
$title = "ve^xx's test!";
$title = preg_replace('/[^\w\' -]/', '', $title);
$title = preg_replace('/ +/', ' ', $title);
echo $title;
?>

[vexx]

i'll get on it now...and tnx alot for helping and baring with me 🙂

i'll get right back with the result

[vexx]

ok,i really don't get it, the dash works but the single quote no

i didn't made any php file, i tested it live on the site

Tested the following titles: Test-test, test'ing, test'ing test-test

only the first was displayed

[NogDog]

Could this possibly be a magic_quotes_gpc issue? If so, you may need to apply [man]stripslashes/man first. (You can use [man]get_magic_quotes_gpc/man to test whether it is turned on.)

[laserlight]

ok,i really don't get it, the dash works but the single quote no

Did you test with my small example?

<?php
$title = "ve^xx's test!";
$title = preg_replace('/[^\w\' -]/', '', $title);
$title = preg_replace('/ +/', ' ', $title);
echo $title;
?>

EDIT:

Could this possibly be a magic_quotes_gpc issue?

I do not think so, since the slashes would be stripped by the preg_replace call. Another possibility is that the title is used in an attribute whose value is single quoted, but that should result in a cutting off of text after the single quote, not completely no text. Yet another possibility is that display_errors is Off and vexx is typing code like:

$title = 'test'ing';

But from what I see $_POST['title'] is used, thus this syntax error should not be the case.

[vexx]

ya, i did and it works ofc...but live, directly on my website it doesn't

here is the full code for that, maybe you guys can figure it out, i simply can't:

$title='';
if($_POST['title']=='')
	$error.='ERROR: choose title!<br>';
else
	{
$title = preg_replace('/[^\w\' -]/', ' ', $_POST['title'] );
$title = preg_replace('/ +/', ' ', $title);
}

p.s. your test was also made on the server on which this site is hosted, but on a single test.php file

edit: title is varchar(100) within the db

[laserlight]

Where do you print the title?

[vexx]

the title is being printed on several parts within the website but the problem is, when i add the ' within the title, the title isn't injected in the db and i have no records of that title if it contains '

[laserlight]

the title is being printed on several parts within the website but the problem is, when i add the ' within the title, the title isn't injected in the db and i have no records of that title if it contains '

Oh! I see, you are having an SQL injection problem.

You need to escape the incoming string input used in your SQL statements, e.g., by using prepared statements, or for the legacy MySQL extension, [man]mysql_real_escape_string/man.

EDIT:
By the way, we normally say "inserted" or "updated" when talking about SQL INSERT or UPDATE statements, since "injected" refers to something potentially malicious, but I must say that it is ironically apt and happens to describe what is happening right now in your script.

[vexx]

ok, now i'm 100% foggy 🙂

can you give me a small example for my particular case so i can have a good start on this?

tnx alot

[laserlight]

can you give me a small example for my particular case so i can have a good start on this?

I have to go offline right now, but you should tell us what is your database interface (e.g., MySQL, MySQLi, PDO) and provide the SQL statement in question.

[vexx]

i found those lines in the php and i think it has something to do with it:

ini_set('magic_quotes_gpc','0');
ini_set('magic_quotes_runtime','0');
set_magic_quotes_runtime(0);

I am using MYSQL and i will post the code soon

p.s. a part of the code was made by another programmer, that's why i discovered this thing now, so pls excuse me 🙂

edit: and being stupid by nature, i forgot to mention probably the most important thing, the script is using the fckeditor, from which I input the titles and such

include("functions/fck/fckeditor.php");

[laserlight]

i found those lines in the php and i think it has something to do with it:

ini_set('magic_quotes_gpc','0');
ini_set('magic_quotes_runtime','0');
set_magic_quotes_runtime(0);

Those turn off magic quotes, though if I remember correctly they are not useful since the incoming data are escaped by the time control reaches that point. In any case, I reasoned that the magic quotes setting is not relevant to your problem.

edit: and being stupid by nature, i forgot to mention probably the most important thing, the script is using the fckeditor, from which I input the titles and such

include("functions/fck/fckeditor.php");

It might be important, but for now the evidence points to an insecure script with respect to SQL injection.