Does regex special character allowing security break?

Question

My regex looks like this.

    if (preg_match("/^[a-zA-Z0-9~@#$^*()_+=[\]{}|\\,.?: -]*$/", $text) == FALSE) {
      echo 'Wrong!'
    }

I want to allow special characters ' and " sign too. How should I better implement it? And whether it is a security break for mysql database.

possible duplicate of [Regex pattern including all special characters](http://stackoverflow.com/questions/18057962/regex-pattern-including-all-special-characters) — Narendrasingh Sisodia, Aug 04 '15 at 13:39
I mean that does it will not allow some sql injection vulnerability open if I let such characters as ' or others to be inserted into database. — user3284181, Aug 04 '15 at 13:41

score 1 · Answer 1 · answered Aug 04 '15 at 18:51

SQL injection is best prevented by escaping anything that comes from the user. Without such,

WHERE x = '$x'

with $x being

' OR true OR '

turns into

WHERE x = '' OR true OR ''

thereby letting the hacker in without knowing the right value for x. Variants of this hack allow really nasty things to happen.

Escaping would give

WHERE x = '\' OR true OR \''

which will suitably fail, and the hacker will move on to another way to break through your defenses.

score 0 · Accepted Answer · answered Aug 04 '15 at 13:24

0

Tell me exactly what characters and symbols you want to enable in the field? I will edit the regex.. Basically it should look like this:

$yourString = "blahblah";
if (preg_match('/^[A-Za-z0-9_-]*$/', $yourString)) {
    #your string is good!
}
else {
    #your string is wrong.
}

answered Aug 04 '15 at 13:24

Ilanus

I want a till z, A till Z, 0 till 9 and all special characters which are on keyboard ~ ` ! @ # $ % ^ & * ( ) _ + = - } { | " : , . / \ ? ; ' – user3284181 Aug 04 '15 at 13:36
use /^[a-zA-Z0-9!@#\$%\^\&*\)\(+=._-]+$/g – Ilanus Aug 04 '15 at 13:39
Use `/^[a-zA-Z0-9!@#\$%\^\&'"*)\]\[(+=._-].*/` – Narendrasingh Sisodia Aug 04 '15 at 13:44
Does ' and " can't be implemented as allowed? – user3284181 Aug 04 '15 at 13:47

2 Answers2