regex syntax error - maybe?

[russia5]

Hello, this is my code for Regex text box discrimination.

Code: Select all


if (empty($_POST['id'])) $id = 0; else $id = $_POST['id'];

if (!preg_match("/[a-z0-9].\:\?\!\"\-]$/i), $id);
{
  preg_replace("*")

{else return $id;

}
}



I get an error way down the page, so I am not sure the error is with the syntax coding. Does anyone see a problem with my code.

Second, am I doing the best thing here. This is for a profile submission, so it is important that because someone use a bad character, the connection not die, hence destroying a valuable submission. I can live with * in place of bad characters, but I would like to use the best method.

Am I under the right impression that this !preg_match will not allow characters other than what I have specified to be put into the database nor pulled to the HTML page? Or echoed after the code? ( I beat my head for a week learning that mysql_real_escape_string() did not actually put / in the output.

Thanks Greg

[gesf]

Code: Select all

<?php

$id = int (empty($_POST['id'])) ? 0 : $_POST['id'];

// OR

if(empty($_POST['id'])) {
     $id = 0;
} else {
     $id = $_POST['id'];
}

// You miss the last double quote

if (!preg_match("/[a-z0-9].\:\?\!\"\-]$/i"), $id) {
     // preg_replace("*");
     // Check the manual page for: preg_replace();   
} else {
     return $id;
}

?>

Use error_reporting(E_ALL); at first in your code.

[russia5]

Thankyou Very Much! You did it! I got it working. Or at least, not putting on an error.

Let me ask you, if the code is working, are the characters that are not in the regex string, still display in the output, and they are just given literals - such as in mysql_real_escape_string() output. The point is, when I put in characters like ) and > they still appear in the output.

Also the same is true for this code:

Code: Select all

 function check_inject()
   {
     $badchars = array(";", "'", "\"", "*", "DROP", "SELECT", "UPDATE", "DELETE", "-");
   
     foreach($_POST as $value)

     

Should DROP, SELECT, UPDATE and DELETE, if input into the text box, appear in the output. If not, what should appear?

Thanks Greg [/code]

[gesf]

Not sure if i get your point russia5... can you say it in other words !?
Are making a protection script against SQL injection !?

[russia5]

At this point, gesf, I am just trying to learn security and to apply a bunch of scripts to my site to secure it up. But later, I believe a script you can put on a form page or password page to protect the page would be a great product.

On my question: the preface being - you know how mysql_real_escape_sting() puts in escapes that turn the characters into literal values and that the characters still show up in the database and output? Well on my bad characters in_array() below, I still get the words that I type in the input, in the output. It does not kill the connection. I was wondering if this was normal? Say, if I type in DELETE and it is in in_array(DELETE) rather DELETE showed up in the output anyway, but the effects were mitigated someway as in mysql_real_escape_string() does to its characters.

The point is, how do you tell rather in_array() is working? Maybe just the fact that it is there and you arn't getting an error?

[gesf]

Try this out:

Code: Select all

<?php

// Use it like: index.php?id=whatever

$variable = trim($_GET['id']); // Or $_POST
$your_array = array('whatever','whatever1','whatever2');

print (in_array($variable, $your_array)) ? 'In Array!' : 'Not In Array!';

?>

The "key" here is the trim() function which strips whitespace from the beginning and end of the string. I know this sounds stupid, but you'll get your problem solved with this ;)