[RESOLVED] Special character insert/output strategy

BEFOR

a) Special characters are being inserted from a form, into a longtext column.
I am first trying to choose what might best serve as a substitute to replace the characters with (ie $1 for $,$2 for !, $3 for ", etc )

b) Does this look like a candidate for a preg_replace function to perform these multiple replacements for being inserted? Will substr_replace work (intended for text within portion of a string)? What about str_replace (all occurrences of the search string with the replacement string)

Same question for echoing back the results.

dagon

why not set your db and html page to handle special characters (i assume you mean non ascii) set all to utf8

BEFOR

I want to prevent special characters like % and $ from being inserted due to possibility of malicious code being executed.

dagon

you don't need to, you just need to escape then mysql_real_escape_string

jerseyzz

Travis Moen (born April 6, 1982) is a Canadian professional ice hockey player currently playing for the Montreal Canadiens #32 Travis Moen Red NHL Jerseys of the National Hockey League (NHL). Although he was born in Swift Current, he grew up in Stewart Valley, Saskatchewan. He was originally drafted in the fifth round of the 2000 NHL Entry Draft by the Calgary Flames, however, he never played for the club.

BEFOR

For inserting characters: %?$!&%"

<?php
        function escape($messages)
        {
                $find=array("\%","\?","\$","\!","\&",\%,'"');
                $replace=array("\%","\?","\$","\!","\&",\%,'"');
                return str_replace($search,$replace,$messages);
        }
?>

Calling them back thru query:

<?php
echo stripslashes($insertedmessages);
?>

other, to remove all special characters:

$messages = mysql_real_escape_string($messages);

BEFOR

(apology for the double post)

Does it matter if magic_quotes is on? Regardless, I flagged them off through htaccess file.

dagon

but why?

BEFOR

Had to, so the pre_match would recognize the quote.

Even at that, can't get the apostrophe to be recognized (preg_match)

BEFOR

if(!preg_match('/^[-A-Za-z\s\'\"]{2,10}$/', $content)){
echo "not allowed";}

Any idea why the apostrophe doesn't want to process? Meaning, it does not trigger an error, but leaves the page seemingly empty. Even though something like... test'd ...can be echoed prior to it.

The " in the same instance works and lets the form validate. Tried enclosing the regex in double quotes, didn't make a difference.

Obviously the ' is interfering but how to write this so it doesn't?

BEFOR

My flub:
In the function, $find array, each should be without the backslashes of course.

And the match on the apostrophe does work if the slash is added before the check.

BEFOR

Sorry, prior post is not right ( backslash)

The ' in the expression must be followed by characters.

robinjackman

don't require to do anything.