preg_match to remove forbidden chars? - php

Question

I'm trying to remove forbidden chars from a string.
$forbidden = array( "<", ">", "{", "}", "[", "]", "(", ")", "select", "update", "delete", "insert", "drop", "concat", "script");
foreach ($forbidden as $forbidChar) {
if (preg_match("/$forbidChar/i", $string)) {
return TRUE;
}
return FALSE;
}
But it's not working as expected, where did I go wrong?

Answer 1

You can do this with a single regex like this:
$forbidden = array(
"<", ">", "{", "}", "[", "]", "(", ")",
"select", "update", "delete", "insert", "drop", "concat", "script");
$forbidden = array_map( 'preg_quote', $forbidden, array_fill( 0, count( $forbidden), '/'));
return (bool) preg_match( '/' . implode( '|', $forbidden) . '/', $string);
This properly escapes all of the characters with preg_quote(), and forms a single regex to test for all of the cases.
Note: I haven't tested it, but it should work.

Answer 2

You need to use preg_replace() if you want characters to be replaced. Not preg_match().
You may also want to ensure that your forbidden characters are properly escaped using preg_quote().

Answer 3

You need to escape the character "[", "]", "(", ")" with "\[", "\]", "\)", "\)"
Here is the working code,
<?php
$string = "dfds fdsf dsfs fkldsk select dsasd asdasd";
$forbidden = array(
"<", ">", "{", "}", "\[", "\]", "\(", "\)",
"select", "update", "delete", "insert", "drop", "concat", "script");
foreach ($forbidden as $forbidChar) {
if (preg_match("/$forbidChar/i", $string)) {
exit('Forbidden char dtected');
return TRUE;
}
return FALSE;
}
?>

Answer 4

You can use the performanter string_replace function to do this
<?php
$forbidden = array(
"<", ">", "{", "}", "[", "]", "(", ")",
"select", "update", "delete", "insert", "drop", "concat", "script");
$cleanString = str_ireplace($forbidden, "", $string);
?>