REGEX validation

Hello, all. I have a simple name field in and eForm form and want to restrict the character set to alphanumeric and white space to prevent anyone from trying to inject commands in my input. I thought I would use a REGEX. I tried:

eform="Full Name::1:Alphanumeric characters only:#REGEX ’[\w ]*’" (I suppose I should add \. and \-)

I also tried:
eform="Full Name ::1:Alphanumeric characters only:#REGEX ’[^\!\@\#\$\%\&\*\(\)\+\{\{\}\]\<\?]*’"

Neither of them prevented me from entering "John A. @Sullivan III" What am I doing wrong? By the way, how does one check to make sure a non-required string contains only valid characters, e.g., eform="Full Name::0:Alphanumeric characters only:#REGEX ’[\w ]*’" I get the impression that such a statement will not do any validation. Should I again rely on regular expressions, e.g., ’[\w ]*’ rather than ’[\w ]+’? Thanks - John

Argh! brain cramp. I forgot to anchor the expression #REGEX ’^[\w \-\.]$’

It is also working with required set to 0 - John

As a suggestion, it’s much better (from a security standpoint) to set up the regex to allow only permitted characters, rather than deny forbidden ones. Basically you only want the regexp to accept [A-Za-z0-9.] or some similar subset. That way you don’t have to worry you forgot to exclude some forbidden character

Thank you. Does [A-Za-z] allow for extended ascii characters, e.g., umlauts? Does [\w \.\-] do any better? If not, how does one account for latin characters outside of basic ascii? Thanks again - John

http://www.pcre.org/pcre.txt
http://au3.php.net/reference.pcre.pattern.syntax
http://www.regular-expressions.info/php.html

Quote from: gracedman at Jul 10, 2007, 05:21 AM

Thank you. Does [A-Za-z] allow for extended ascii characters, e.g., umlauts? Does [\w \.\-] do any better? If not, how does one account for latin characters outside of basic ascii? Thanks again - John

Generally, if you’re using standard PCRE regexp, then [A-Za-z] should cover any alpha character in your language. Now the trick question of course is whether this will work on your particular PHP setup. My suggestion would be to test, test, test with your specific environment. Sorry, wish I could be of more help in this case.

Thanks very much. I did notice from the referenced documents that it does seem to be dependent upon the locale setting. Now if only standards committees were around when language was invented

Gracedman: I’d love to know what expression you ended up using, if you don’t mind sharing it..?

I’m sure it could be improved but here’s what I did:

<input type="text" name="fname" size="50" maxlength="254" eform="Full Name::0:Alphanumeric characters, space, dash, and period only:#REGEX ’^[\w\-\. ]*$’" />

Hope it helps - John