PHP function for removing all invalid characters

Question

I've been trying and searching for a working solution, but nothing seemed to work..

I'm making a social website, where the users can post. I would like to check the text before it goes into the database.

I would like to make the regular characters enabled (a-zA-Z0-9) + some utf8 characters (áÁéÉíÍóÓöÖőŐúÚüÜűŰ) and some other characters (.,?!;. etc.)

I've been trying, but it doesn't seem to work:

preg_replace('/[^a-zA-Z0-9áÁéÉíÍóÓöÖőŐúÚüÜűŰ \.\,\?\!\:\;\-\+\<\>\%\~\€\$\[\]\{\}\@\&\#\*\"\„\”\/]/', '', $string);

Could someone help me out?

Is there anything easier? The reason why I'm doing this is because I don't wanna allow the users to spam the database with illegal characters, or HTML tags.. It would be so bad if someone wrote a post like this "blabla</div>".

What's an *"illegal character"*? And why not just use utf-8 but apply `strip_tags()`? — CD001, Aug 30 '16 at 13:48
Maybe Duplicate? - http://stackoverflow.com/questions/1401317/remove-non-utf8-characters-from-string — Julyano Felipe, Aug 30 '16 at 13:52
You say you don't want users to submit HTML tags, but all of the characters necessary to write them are white-listed in your regex. — iainn, Aug 30 '16 at 13:53
That `preg_replace` call also looks like it works fine - what actual problems are you having? See https://eval.in/631655 — iainn, Aug 30 '16 at 13:54
..."_It would be so bad if someone wrote a post like this "blabla"._"... what does that mean? — M. Eriksson, Aug 30 '16 at 13:54
If you aren't using markdown or bbcode for your site, you should probably look into [HTML Purifier](http://htmlpurifier.org/comparison) — Ixalmida, Aug 30 '16 at 17:35

score 0 · Answer 1 · answered Aug 30 '16 at 19:02

If you are using a textarea or input value to record the User entries, you could use a str_replace() function to search through the string of characters to replace the illegal characters. Link to str_replace in php manual: http://php.net/manual/en/function.str-replace.php

Code example:

    <?php
      $userInput = "Tex.t tha!t wil;l be te>sted that is inp?uted b;y user";
      //Following Array is all characters you deem unwanted
      $illegalChar = array(".", ",", "?", "!", ":", ";", "-", "+", "<", ">", "%", "~", "€", "$", "[", "]", "{", "}", "@", "&", "#", "*", "„");
      $charString = str_replace($illegalChar, "", $userInput);
      echo $charString;
      //Output is "Text that will be tested that is inputed by user"
    ?>

You basically make an array of unwanted chars, and then use the str_replace function to erase them. if you wish to check an html form that is involved with a textarea or input value, make $userInput = — BigBen_Davy, Aug 30 '16 at 19:04

PHP function for removing all invalid characters

1 Answers1