Help with my Preg_replace function

andreea115

Hello everyone

i have a slight problem with my preg_replace function;

i am using the following function to sanitize an 'imput field ' on a form.


 $firstname      =       preg_replace('#[^A-Za-z0-9]#i', '',   $firstname);

I am trying to prevent users from imputing character symbols like '@' in the field.

The function works, it however eliminate all 'white space'. thus, if a user has two name, the function joins the two names togehter.

how can i recode the function so that it keep the space between the two names.

Thanks for your help everyone.

warm regards

Andreea

Damian_

I would validate the form using the script from this site
http://www.javascript-coder.com/html-form/javascript-form-validation.phtml

It is very easy to use.

The reason for this is because the user may input a username for instance:

User: "t%st*@" and when it goes through our script it will end up looking like this "tst" because you have stripped everything, so the next time your user comes back they will use "t%st@" and not know their username is actually "tst" which means you will have to keep putting that preg_rplace code everywhere.

Where if you put the javascript validator the user will be warned that they used the wrong syntax and will not run any php scripts until the user puts something acceptable in.

Of course you can do checks with php, but it will take longer to write, where as that script on the page i have highlighted does a pretty good job, and you can also use ajax so it can do validate as the user is typing!!!

I use that script alot!

bradgrafelman

You still need to do the validation on the server side; never trust client-side only validation (e.g. using Javascript) since it can be easily bypassed.

EDIT: And to answer the OP's original question..

andreea115 wrote:
how can i recode the function so that it keep the space between the two names.

One easy way would be to simply add a space at the end of the character class in the regular expression.

EDIT2: Also note that I would question why you're choosing to simply strip out unwanted characters and then accept the resulting string as input rather than simply rejecting the submission altogether if any data fails validation, thus allowing the user to correct the input (which is probably more involved than simply removing the illegal characters).

Damian_

i normally use htmlspecialchars aswell on the php side to make sure nothing nasty goes through!!

in what ways can someone bypass javascript? i haven't had any issues with the forms, but i would like to know how i can test for that eventuality make my forms more secure?

Damian_

ok no worries, i have just bypassed my own form, oh god how embarrassing. i have to go back and add extra php validation too.