Question

I have a list of bad words in the database. Everytime a user submit a comment, a function goes through the entire list of bad words and replace each word with *

  $query  = "SELECT * FROM bad_words ORDER BY id ASC";
  $result = mysql_query($query);    
  while($row = mysql_fetch_array($result, MYSQL_ASSOC))
  {
   $word =  $row['word'];
   $replacement =  "***";

      $userInput = str_replace(" $word ", $replacement." ", $userInput);
  } 

The problem is that str_replace does not work properly. For instance, “associated” will become “***ociated”. I have also tried to use this preg_replace

$userInput = preg_replace("|\\b$\word\\b|i",$replacement,$userInput);

but it is not working for some reason. Some of the bad words in the database contains characters like
@ | , ! * ) . ^ ' ( @

my guess is that these characters are causing preg_replace to fail. Is there anyway around this?

Answer 1

Putting aside issues of whether this is a good idea, implementation is pretty simple:

$userInput = preg_replace('/\b' . preg_quote($word, '/') . '\b/i', $replacement, $userInput);

You can probably also improve performance by using a single replacement:

$words = array();
$replacement =  "***";
$query  = "SELECT * FROM bad_words ORDER BY id ASC";
$result = mysql_query($query);    
while($row = mysql_fetch_array($result, MYSQL_ASSOC)) {
    $words[] =  preg_quote($row['word'], '/');
} 

$userInput = preg_replace('/\b(' . implode('|', $words) . ')\b/i', $replacement, $userInput);