PHP: Deal with delimiters in dynamic regular expression - php

Question

Let's say I want to create a PHP tool to dynamically check a string against regular expression pattern. There is one problem with that: delimiters.
I would like to be able to do the following (simplified example):
$pattern = $_POST['pattern'];
$matched = (preg_match($pattern, $_POST['string']) === 1);
I don't want the users to put delimiters in the input, just a pure pattern, like ^a[bc]+d. How to deal with delimiters? I could do this:
$pattern = '/' . $_POST['pattern'] . '/';
Or with any other possible delimiter, but what about escaping? Is placing \ before each character in the pattern, being the same one as the delimiter of my choice, enough? Like this:
$pattern = '/' . str_replace('/', '\\/', $_POST['pattern']) . '/';
What is a neat way to deal with delimiters?

Answer 1

You have to check the input to identify the delimiter if there is any and remove it. This way if the user follows the rules, you don't have to worry, but if they don't the delimiter is removed anyway. The delimiter can be identified by comparing the first and last character.
// with incorrect input.
$input = "/^a[bc]+d/"; // from $_POST['pattern']
$delim = "/";
if ($input[0] === $input[strlen($input) - 1]) {
$delim = $input[0];
}
$sInput = str_replace($delim,"",$input);
echo $sInput; // ^a[bc]+d
With correct input, you don't have to worry.
$input = "^a[bc]+d"; // from $_POST['pattern']
$delim = "/";
if ($input[0] === $input[strlen($input) - 1]) {
$delim = $input[0];
}
$sInput = str_replace($delim,"",$input);
echo $sInput; // ^a[bc]+d
$sInput is your sanitized pattern. You can use it directly to test your string.
$matched = (preg_match($sInput, $_POST['string']) === 1);