Include backslash in regular expression for URL sanitize?

Question

I have the following regular expression:

$url = "http://example.com?param=test1\test2\test3\test4";

$cleanUrl = preg_replace('|[^a-z0-9-~+_.?\[\]\^#=!&;,/:%@$\|*`\'<>"()\\x80-\\xff\{\}]|i', '', $url);

I get the following output:

http://example.com?param=test1est2est3est4

But, I'm expecting the following output:

http://example.com?param=test1\test2\test3\test4

I tried to this regex, but it's not working:

    $cleanUrl = preg_replace('|[^a-z0-9-~+_.?\[\]\^\\#=!&;,/:%@$\|*`\'<>"()\\x80-\\xff\{\}]|i', '', $url);
                                                    ^ escaped single quote

Answer 1

Perhaps, what you are doing can be achieved with other means, but answering your question, I should note that your input string does not contain backslashes, it contains tab characters as inside double quoted string literal, \t defines an escape sequence.

Once you use a single quoted literal, \t denotes 2 symbols. Now, the regex does not have \. You need to add it with \\\\:

$url = 'http://example.com?param=test1\test2\test3\test4';
$cleanUrl = preg_replace('|[^-\\\\a-z0-9~+_.?\[\]^#=!&;,/:%@$\|*`\'<>"()\x80-\xff{}]|i', '', $url);
echo $cleanUrl;

See this PHP demo printing http://example.com?param=test1\test2\test3\test4.

I also moved the - to the beginning (it is just best practice to put it at the start or end of the character class if it should match a literal hyphen), and ^ that is not in the initial position in the char class does not have to be escaped. Same goes for {, }, and also [, but that square bracket is better escaped (some regex flavors disallow unescaped [ in the character class).