preg_match

A-GB

On one of my forms I have two input boxes for longitude and latitude. Firstly I need to make sure these are valid, and secondly stop any sql injection techniques. I guess this can all be done by preg_match?

Examples of valid inputs:
1.52415
49.20158
-2.65548
-50.50124

Example of invalid inputs:
dslkhsdj
"klh2'@#';.?@
654654
324.24324.24.2

Can someone help me out with the preg_match code for this.

Cheers

dagon

i found a dozen solutions via google, i could copy and past here, or you could just google it yourself.

bradgrafelman

As far as preventing SQL injections, I would just use something like [man]floatval/man.

A-GB

Thanks brad.

If I used the two functions shown below, would this be sufficient to protect text POST data going into MySQL?

functions stripchar($data) {
	$data = trim($data);
	$data = ereg_replace("[^A-Za-z0-9]", "", $data);
	return $data
}

functions mysqlre($data) {
	$data = trim($data);
	mysql_real_escape_string($data)
	return $data
}

bradgrafelman

Well no, since if you used the two functions above you'd get parse errors and your code wouldn't even run at all.

Assuming you fixed the parse errors (missing semicolons, 'functions' typo, etc.), however, you'd still have some problems...

The ereg*() functions are deprecated - use the [man]PCRE[/man] functions instead.
This line:
```
mysql_real_escape_string($data);
```
(semicolon added) doesn't do anything and might as well not even be there. Why? You aren't storing (or otherwise using in any way) the value returned by the function.
Neither of the functions is suitable to use for numeric data.
The 'stripchar' function seems overly restrictive to be of much use in the general case.