Removing back slashes and double quotes?

Anon

Hi, I'm running in to problems with removing back slashes and double quotes from my strings. I need to be able to do this because the string becomes a file name. And those two charicters seem to cause problems in the rest of my php. So I would just like to strip them apon etery as they are not needed. I wanted to use ereg_replace but escaping those charicters dosn't seem to work and I still get errors.

ie..

$sectionname = ereg_replace ('\"', " ", $sectionname);

$sectionname = ereg_replace ("\"", " ", $sectionname);

and

$sectionname = ereg_replace ("\", " ", $sectionname);

all don't work!

Can anyone help me with the propper way to do this?

van__

$string = preg_replace('/[\"]*/','',$string);

van__

damn me and my typo habit...
$string = preg_replace('/[\"]*/','',$string);

...forgot to escape the b-slash

frigidman

I use this little function a lot when dealing with taking a short string and making it 'clean' for things like filenames, or keywords and the like.

Helps strip out that garbage Œsc” too.

function Keep($orig_data='',$keepchars='',$casecontrol=''){ 
	$keep_pattern = "/[^".$keepchars."]/".$casecontrol;
	return preg_replace($keep_pattern,"",$orig_data);
}

You call it like:
$safe_string_for_filename = Keep($input,'a-z0-9_-','i');

It allwos you to custom throw in chars you want to "keep" (thus the name of the function). If you pass it the 'i' in the third param, then it wont care about case, otherwise it would (just a feature I used rarely). It will take ranges, a-z 0-9, and other specific chars (even a space too).

Works really well, and I have yet to run into a problem with it.

This function stemmed from my previous experience with a pathetic language called "Tango"... it had a nice "Keep" function that worked crudely like this.

ANYHOW, to your issue, just run your input string through the Keep function, and it will strip out any nasty chars that you do not want. And since you only want to use it for a filename, then the above example would work great, since it only keeps chars that are safe for a filename!

Anon

Or try this
$var = str_replace("\","",$string);

[deleted]

"Can anyone help me with the propper way to do this?"

read inc.hat's post, just removing bad chars is not enough, you could still get names like '/etc/passwd', which are very dangerous.

Don't store any file on your server with a name that a user defined. Instead, make up a random name, and store the 'original' name somewhere else, like in a database.

A forum, a FAQ, what else do you need?

Time to YAPF!: http://www.hvt-automation.nl/yapf/

Anon

I'll just strip the / chariter too 🙂

Anon

Just wanted to say thank you all for helping me with this problem 🙂

frigidman

My little "Keep" function works where you only keep valid chars.

Did my example have the "/" in the keep chars? No... so that char wouldn't exist in the output.

If it 'only' keeps A through Z, zero through nine, underscores and dashes, then whatever comes out will ALWAYS be safe for a filename.

Many times using random crud for a filename is horrible. You get file downloads, or other management with garbage names and the site looks pathetic and highly unprofessional.