Re: Stripping out all illegal characters for a folder name
| From: | CPT John W. Holmes | Date: | Wed, 26 Nov 2003 16:00:42 +0000 |
| Subject: | Re: Stripping out all illegal characters for a folder name | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-171087@lists.php.net to get a copy of this message | ||
Sorry for the reply to the reply, but OExpress won't let me reply to
newsgroup posts...
From: "Sophie Mattoug" <sophie@sitadelle.com>
> Joseph Szobody wrote:
> >I'm taking some user input, and creating a folder on the server. I'm
already
> >replacing " " with "_", and stripping out a few known illegal
> >characters
(',
> >", /, \, etc). I need to be sure that I'm stripping out every character
that
> >cannot be used for a folder name. What's the best way to do this? Do I
have
> >to manually come up with a comprehensive list of illegal characters, and
> >then str_replace() them one by one?
>
> I think you should use the reverse solution : have a list of authorized
> characters and strip out all others ones.
That's exactly it. You need to change your way of thinking. When ever you
are dealing with user input, you want to define what is GOOD and only allow
that. If you try to define what is BAD, you'll leave something out.
As for an answer:
$safe_foldername = preg_replace('/[^a-zA-Z0-9]/','',$unsafe_foldername);
That'll remove anything that's not a letter or number. Adapt to your needs.
---John Holmes...