Question

I have the following function which as you can see, replaces certain characters in a string with the pattern, yet it only works when I enter in the pattern as a string like in the first commented out line. I put an echo in there to test what was coming back and its as it should be so I dont know whats going on! Has anyone any clues?

    private function check_string( $s )
    {
        //return preg_replace( '/[^a-z 0-9~%\.:_\\-()"]/i', '', $s );

        // a-z 0-9~%\.:_\\-()"
        echo $this->permitted_uri_chars;

        // /[^a-z 0-9~%\.:_\\-()"]/i
        $pattern = '/[^'. $this->permitted_uri_chars .']/i';    
        return preg_replace( $pattern, '', $s );            
    }

The error I get is

Message: preg_replace(): Compilation failed: range out of order in character class at offset 18

ANSWER

---

Thanks to Jason McCreary

$pattern = '/[^'. preg_quote($this->config->item('permitted_uri_chars'), '/') .']+/i';

Answer 1

It is working in the first example because you properly escaped characters for both PHP and the Regular Expression. (i.e. \\).

When using a string, you have only escaped for PHP. So when you use this string in your Regular Expression it is no longer escaped.

This is demonstrated by the following example:

echo '/[^a-z 0-9~%\.:_\\-()"]/i';
// becomes: /[^a-z 0-9~%\.:_\-()"]/i

A few options would be:

• Double escape.
• Avoid the Regular Expression escaping by placing the dash at the end: /[^a-z 0-9~%.:_()"-]/
• Use preg_quote() if you’re going to accept strings regular expression syntax.

Note: I’d encourage you to read about escaping inside character classes.