Vfrdtyky

I am currently using a PHP form processing code that accepts text field submissions. My code is this:

function checkInput($f) {

    $f = strtr($f, array('Š' => 'S','Ž' => 'Z','š' => 's','ž' => 'z','Ÿ' => 'Y','À' => 'A','Á' => 'A','Â' => 'A','Ã' => 'A','Ä' => 'A','Å' => 'A','Ç' => 'C','È' => 'E'));  

    $f = strtr($f, array('Þ' => 'TH', 'þ' => 'th', 'Ð' => 'DH', 'ð' => 'dh', 'ß' => 'ss', 'Œ' => 'OE', 'œ' => 'oe', 'Æ' => 'AE', 'æ' => 'ae', 'µ' => 'u'));  

    $f = preg_replace(array('#( ){2,}#', '#(.){4,}#', '/[^w-_.:, ]+/'), array(' ', '...', '_'), $f);  

    return $f; 

}  

This code checks characters with accents and replaced those with the 'regular' characters without accents. And the preg_replace line checks:

1. if there are 2 or more consecutive spaces, if yes: replace with 1 space;

2. if there are 4 or more consecutive dots, if yes: replace with 3 dots;

3. if there are any non-matching characters, if yes: replace those with an underscode (_);

I want to support unicode characters from other language, for example Cyrillic. Is it enough to just add a u in the preg_replace line? Example:

$f = preg_replace(array('#( ){2,}#', '#(.){4,}#', '/[^w-_.:, ]+/u'), array(' ', '...', '_'), $f);   

I am not sure if that is the way to go in terms of security. Please advise.

EDIT:

This regex seems to be working, it restricts allowed chars to the specified chars in the regex, but it does not allow non-Latin chars..

/^[a-z0-9.,:!?-_ ]+/iu  

I want to allow chars: a through z (case insensitive), 0 through 9, . , : ! ? - _ white space and non-Latin chars.

EDIT2:

Ok now this seems to be working correctly in code:

$rgx = '/[^a-z0-9-_.:,!?w ]+/iu';  

$f = preg_replace($rgx, "", $f);  

$f = preg_replace(array('#( ){2,}#', '#(.){4,}#'), array(' ', '...'), $f);  

return $f;

It allows chars a - z, digits, - _ . : , ! ? and non-Latin chars. And replaces any restricted characters like quotes " ' and semi-colons ; to prevent SQL injections.

Allow me to clean up your Edit #2 patterns and suggest a single-call implementation.

Code: (Demo)

function sanitizer($string) {

    return preg_replace(['~[^p{L}p{N}_.:,!? -]+~u', '~ K +|.{3}K.+~'], '', $string);

}



$strings = [

    "1: Доброе утро - Dobraye ootro &       Good morning",

    "2: Добрый день => Dobriy den'....... (Good afternoon)"

];



foreach ($strings as $string) {

    echo sanitizer($string);

    echo "n---n";

}

Output:

1: Доброе утро- Dobraye ootro Good morning

---

2: Добрый день Dobriy den... Good afternoon

---

I could have written a single piped pattern for preg_replace() but I wanted to make two passes over the string. 1. to remove any invalid characters then 2. to remove excessively long character sequences that may or may not have been formed by the first pass.

Noteworthy pattern changes:

1. [a-zA-Z0-9_] is more simply written as w however because you are using the u flag AND to prepare for PHP7.3's strict adherence to PCRE2, it is better two write out: p{L}p{N}_




2. Avoid writing unnecessary slashes before characters without special meaning -- it only makes your pattern longer and harder to interpret. Character that normally have special meaning (like *, ?, +, etc) lose there special meaning inside of a character class [ ... ].




3. Move your hyphen to the front or back of your negated character class to avoid the possibility of writing a range of character. (because your - came after a range of characters 0-9, this was a non-issue, but it is good advice to remember as a matter of best practice.




4. K means "forget the previously matched substring" in other words, "start matching from here". This enables you to avoid a capture group and just truncate the unwanted characters by replacing the match with an empty string.

p.s. You should still run your strtr() calls as your original post has done.