php remove URLs from form submission - php

Question

I have a parish website that I am maintaining. The site has a parish registration form on it. Yesterday someone submitted the form with spam. The submitter supplied an inappropriate web address in one of the fields.
I'm fairly confident this was not a bot form submission as I use a recapcha and honeypot to fend off bots.
What I'm trying to figure out is how on the processing page to look at all the text entry fields and scrub URLs.
Since the language is PHP:
function scrubURL(field){
if($_POST[field] contains **SomeURL**){
$field = str_replace(***SomeURL***, "", $_POST[field])
} else{
$field = $_POST[field];
}
return $field;
}
I'm just not sure to check the field to see if it contains a URL.
I'm planning to scrub URLs by calling:
$first = scrubURL($first);
$last = scrubURL($last);
$address = scrubURL($address);
I will then use $first, $last & $address in the mail that gets sent to the parish office.

Answer 1

This function will recognize URLs and replace then with empty strings. Just realize that lots of thing, such as wx.yz look like valid URLs.
function scrubURL($field)
{
//return preg_replace('#((https?://)?([-\\w]+\\.[-\\w\\.]+)+\\w(:\\d+)?(/([-\\w/_\\.]*(\\?\\S+)?)?)*)(?:[?&][^?$]+=[^?&]*)*#i', '', $_POST[$field]);
return preg_replace("#((https?://|ftp://|www\.|[^\s:=]+#www\.).*?[a-z_\/0-9\-\#=&])(?=(\.|,|;|\?|\!)?(\"|'|«|»|\[|\s|\r|\n|$))#iS", '', $_POST[$field]);
}
The parameter, $field, has to be a string, such as "email" corresponding to $_POST["email"]
<?php
$_POST = [
'email' => 'something www.badsite.com?site=21&action=redirect else',
];
function scrubURL($field)
{
return preg_replace('#((https?://)?([-\\w]+\\.[-\\w\\.]+)+\\w(:\\d+)?(/([-\\w/_\\.]*(\\?\\S+)?)?)*)(?:[?&]\S+=\S*)*#i', '', $_POST[$field]);
}
echo scrubURL('email');
Prints:
something else

Answer 2

Regex is an easy way to evaluate fields for possible URL markers. Something like the following would remove much of it (though, given how many shapes URLs can come in, not everything):
$_POST = [
'first' => 'actualname',
'last' => 'something http://url.com/visit-me',
'middle' => 'hello www.foobar.com spammer',
'other' => 'visit https://spammery.us/ham/spam spamming',
'more' => 'spam.tld',
];
// Iterates all $_POST fields, editing the $_POST array in place
foreach($_POST as $key => &$val) {
$val = scrubUrl($val);
}
function scrubURL($data)
{
/* Removes anything that:
- starts with http(s):
- starts with www.
- has a domain extension (2-5 characters)
... ending the match with the first space following the match.
*/
$data = preg_replace('#\b
(
https?:
|
www\.
|
[^\s]+\.[a-z]{2,5}
)
[^\s]+#x', '-', $data);
return $data;
}
print_r($_POST);
Be aware that the last condition, looking for any TLD (.abc) -- and there are lots of them! -- may result in some false positives.
"sentence.Poor punctuation" would be safe. We're only matching [a-z].However, spam.Com would also pass! Use [a-Z] to match both cases, or add the "i" modifier to the regex.
"my acc.no is 12345" would be removed (potential spammer accountants from Norway?!)
The above process would give you the following filtered data:
Array (
[first] => actualname
[last] => something -
[middle] => hello - spammer
[other] => visit - spamming
[more] => -
)
The regex can definitely be further refined. ^_^
N.B. You may also want to sanitize the incoming data with e.g. strip_tags and htmlspecialchars to ensure the website is sending reasonably safe data to your parish.