how to use preg_match for whitelisting a string?

Question

i want to check a string contains unwanted character or not. I want to allow only a string which will contains only @ _ a-z . I want if the string contains anything except this character will give me a false output. i want to check a string which will return true if the string doesn't contains my expected characters.

I tried to use preg_match to do this. But unable to do this. I think preg_match isnot the function i need for this. Please suggest me the best way to reach my desire goal.

$text='Hel&o';
if(!preg_match("/.@_[a-zA-Z0-9]/", $text) ){
return false;
}else {
return true;
}

That's a good example of how *not* to validate an email address. — CD001, Nov 15 '16 at 14:17
why not use `filter_var($email, FILTER_VALIDATE_EMAIL)` Check [Manual](http://php.net/manual/en/function.filter-var.php) — bansi, Nov 15 '16 at 14:19
I am trying to check a string with whitelist approach. Please help me to check a string contains nonwhitelisted charecters or not. — wind, Nov 15 '16 at 14:20
filter_var($email, FILTER_VALIDATE_EMAIL) doesnot find errors on su&@kk.net email. — wind, Nov 15 '16 at 14:20
@wind that's because su&@kk.net is a valid email address according to RFC 2822: https://tools.ietf.org/html/rfc2822 — CD001, Nov 15 '16 at 14:22
I want my own solution. I want to skip any text string contains &. Its not about email validation. Its about my own whitelisting a string. — wind, Nov 15 '16 at 14:23
yes bansi i want to know how to check a string contains non expected charecters. I want to approach in whitelisting way. not blacklisting way. — wind, Nov 15 '16 at 14:29

Andreas · Answer 1 · 2016-11-15T14:29:53.637

1

If you insist on using preg_match and not filter_var, then try this:

/^[a-zA-Z0-9.@_]+$/

Edited to add what CD001 commented.

http://www.phpliveregex.com/p/hSI

edited Nov 15 '16 at 14:29

answered Nov 15 '16 at 14:23

Andreas

23,610
6
30
62

1

Probably want a `+` rather than a `*` (can't imagine the OP wants an empty string to match, though you never know) but that does what's requested... oh, and `^...$` to ensure nothing sneaks in. – CD001 Nov 15 '16 at 14:27
@CD001 well, who knows. As long as it's white listed :-) – Andreas Nov 15 '16 at 14:28

score 0 · Answer 2 · answered Sep 24 '20 at 06:52

I've created a little function to filter a string:

function str_whitelist($string, $whitelist, $strict = false) {
    $whitelist = str_split((!$strict ? strtolower($whitelist) : $whitelist));
    $stringsplit = str_split($string);
    for ($i = 0; $i < count($stringsplit); $i++) {
        $string = !in_array((!$strict ? strtolower($stringsplit[$i]) : $stringsplit[$i]), $whitelist, $strict) ? str_replace($stringsplit[$i], '', $string) : $string;
    }

    return $string;
}

Usage:

str_whitelist("Hello123", "ABCDEFGHIJKLMNOPQRSTUVWXYZ") // Output -> Hello

how to use preg_match for whitelisting a string?

2 Answers2