[RESOLVED] Filter_var regex urlencode validate

whisher06

Hi.

I don't see why this code
doesn't work
(only for the filter_input):

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> 
<html> 
<head> 
    <meta http-equiv="content-type" content="text/html; charset=utf-8"> 
    <title>Test</title> 
</head> 

<body> 
<?php 
$pattern= '#^[%_\-\+a-zA-Z0-9\/]+$#'; 
// IT DOESN'T WORK
if(filter_has_var(INPUT_GET, 'qs')){ 
    $options= array('options'=>array('regexp'=>$pattern)); 
    $string=filter_input(INPUT_GET, 'qs', FILTER_VALIDATE_REGEXP, $options); 
    if($string===false){ 
        echo "A filter GET match was not found.<br />";     

    } 
    else{ 
        echo "A filter GET match was found.{$string}<br />"; 
    } 
}  

//IT WORKS   

if(isset($_GET['qs'])){ 
    $string= urlencode($_GET['qs']); 
    if (preg_match($pattern, $string)) { 
        echo "A GET match was found.{$string}<br />"; 
    } else { 
        echo "A GET match was not found.<br />"; 
    }         

} 
//IT WORKS
$string= urlencode('bicycles multi byte chars  èòàù'); 
if (preg_match($pattern, $string)) { 
    echo "A match was found.{$string}<br />"; 
} else { 
    echo "A match was not found.<br />"; 
} 

?> 
<!-- IT WORKS --> 
<a href="<?php echo $_SERVER['PHP_SELF'].'?qs=bicycle_-%'; ?>">test1</a><br /> 
<!-- IT DOESN'T WORK --> 
<a href="<?php echo $_SERVER['PHP_SELF'].'?qs=bicycle_-+%'; ?>">test2</a><br /> 
<!-- IT DOESN'T WORK --> 
<a href="<?php echo $_SERVER['PHP_SELF'].'?qs='.urlencode('bicycles multi byte chars  èòàù#'); ?>">test3</a><br /> 

</body> 
</html>

I should validate a urlencode alphanumeric string
(uppercase/lowercase )
and the chars
_ - % + (the % and + for the urlencode).

I also tried with

$pattern= '#^[%_\-\+a-zA-Z0-9\/\s]+$#';

but it doesn't work.

Can you help me, please ?

Bye.

Weedpacket

I think you'll find that by the time the filter gets the input data it has already been url-decoded (the encoding is just for transport, after all). Consider the pattern [font=monospace]#^[- _%a-zA-Z0-9/]+$#[/font] with your test strings.

Weedpacket

whisher06

Thanks for your help
but it doesn't work yet:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> 
<html> 
<head> 
    <meta http-equiv="content-type" content="text/html; charset=utf-8"> 
    <title>Test</title> 
</head> 

<body> 
<?php 
$pattern= '#^[- _%a-zA-Z0-9/]+$#'; 
// IT DOESN'T WORK 
if(filter_has_var(INPUT_GET, 'qs')){ 
    $options= array('options'=>array('regexp'=>$pattern)); 
    $string=filter_input(INPUT_GET, 'qs', FILTER_VALIDATE_REGEXP, $options); 
    if($string===false){ 
        echo "A filter GET match was not found.<br />";      

    } 
    else{ 
        echo "A filter GET match was found.{$string}<br />"; 
    } 
}   

?> 

<!-- IT DOESN'T WORK --> 
<a href="<?php echo $_SERVER['PHP_SELF'].'?qs='.urlencode('bicycles multi byte chars  èòàù'); ?>">test3</a><br /> 

</body>
</html>

:queasy:

laserlight

I think Weedpacket explained the "problem": the input is not urlencoded by the time you check if it is urlencoded.

whisher06

Thanks I can see the point,
but if now that
we worked out the space
the problem is the multi bytes char
like è ò ç

I'd like to avoid stuff like
str_replace

whisher06

An other approach

function sanatizeString($string){
		$dodgychars= "#[^0-9a-zA-Z]#";
		return preg_replace($dodgychars,"-",$string); 
	}
	var_dump(sanatizeString("Publicità e progresso"));

I catch the dodgy chars before 😃

Weedpacket

#[^0-9a-zA-Z]#

Why not use this pattern in the filter then? (Or rather, its negation: [font=monospace]#^{[0-9a-z]+$#i[/font].)}

whisher06

It could be an idea 🙂

Thanks again.