0

how can I block from input !@#$%^&*() only _ and alphabet ?
This is my code

$query = htmlspecialchars(trim($_GET['search']));
$min_length = 3;
if (strlen($query) >= $min_length) {
    $query = htmlspecialchars(trim($query));
    $query = mysql_real_escape_string($query);
    $raw_results = mysql_query("SELECT * FROM skins WHERE (`username` LIKE '%" . $query . "%')") or die(mysql_error());
}
Даниел Димитров
  • 33
  • 7
  • 1
    "^[a-zA-Z_]*$" should work for if you are allowing upper and lower case – DevlshOne Nov 25 '13 at 16:05
  • why have this line $query = htmlspecialchars(trim($query));, you have already done this before the if? – Pwner Nov 25 '13 at 16:05
  • You still need to go and **tick an answer correct**: [here](http://stackoverflow.com/questions/20029234/mysql-get-random-username/20029355#20029355). – Jimbo Dec 12 '13 at 15:39

1 Answers1

0
$query = htmlspecialchars(trim($_GET['search']));
$min_length = 3;
if (strlen($query) >= $min_length) {
    if(preg_match('/^[A-Za-z0-9_]+$/',$query)){
        $query = htmlspecialchars(trim($query));
        $query = mysql_real_escape_string($query);
        $raw_results = mysql_query("SELECT * FROM skins WHERE (`username` LIKE '%" . $query . "%')") or die(mysql_error());
    } else {
        //do something if $query contains something else than alphanumeric and _ chars
    }
}
Romain
  • 51
  • 3