Question

I’m trying to remove forbidden chars from a string.

$forbidden = array( "<", ">", "{", "}", "[", "]", "(", ")", "select", "update", "delete", "insert", "drop", "concat", "script");
foreach ($forbidden as $forbidChar) {
    if (preg_match("/$forbidChar/i", $string)) {
        return TRUE;
    }
    return FALSE;
}

But it’s not working as expected, where did I go wrong?

Answer 1

You can do this with a single regex like this:

$forbidden = array(
            "<", ">", "{", "}", "[", "]", "(", ")",
            "select", "update", "delete", "insert", "drop", "concat", "script");
$forbidden = array_map( 'preg_quote', $forbidden, array_fill( 0, count( $forbidden), '/'));
return (bool) preg_match( '/' . implode( '|', $forbidden) . '/', $string);

This properly escapes all of the characters with preg_quote(), and forms a single regex to test for all of the cases.

_{Note: I haven’t tested it, but it should work.}