Question

I have a tcl variable $value that is being passed through a hidden input field.
What would be a good regular expression to get it checked for an SQL injection.

I would want it to allow only numbers in case.

I would want it to allow only characters in another case.

And numbers and characters both in another case.

In all 3 cases I do not want any special chracters to be included

Answer 1

switch $case {
  case1 {set regex {^[[:digit:]]+$}}
  case2 {set regex {^[[:alpha:]]+$}}
  case3 {set regex {^[[:alnum:][:space:]]+$}}
  default {error "what case is this?"}
}
if {! [regexp $regex $value]} {
  error "invalid value: value"
}

To remove non-matching chars

switch $case {
  case1 {set regex {\D}}
  case2 {set regex {[^[:alpha:]]}}
  case3 {set regex {[^[:alnum:][:space:]]}}
}
set safe_value [regsub -all $regex $value ""]

See Tcl man pages for regexp, regsub, and re_syntax