Question

If i have input text in form like this

<form action="add.php" method="post">
<input type="text" name="txt" id="txt">
<input type="submit" name="submit" value="Submit">
</form>

and the add.php code is as following

$sql= "insert into mytable set myname='$txt'";
executeupdate($sql);

My question how to filter any text input from any special characters i just want it only Aa-Zz-1234567890 (letters and numbers) only.

Here is my try but i’m not sure will it really filter all special characters or can pass any

i’ve added in add.php the following code

$cleared = strip_tags($txt);
$sql= "insert into mytable set myname='$cleared'";
executeupdate($sql);  // this should clear the name before insert

Any suggestions else or better way?

Answer 1

 $whiteSpace = '\s';  //if you dnt even want to allow white-space set it to ''
$pattern = '/[^a-zA-Z0-9'  . $whiteSpace . ']/u';
 $cleared = preg_replace($pattern, '', (string) $txt);