Question

I’ve set up a website that allows the user to add places to a database. However, I am unfamiliar with regex and so I’m not sure how to allow characters like apostrophes and dollar signs without them affecting the database INSERT.

I have a form, which is read by AJAX and processed with PHP/MySQL so there’s thee languages which have their own “reserved” characters for various uses. Realistically the regex needs to sit in my Javascript before the AJAX sends the string. I’m quite new to Javascript so I’m not sure how I’d go about this.

Is there any chance someone could help with this, but also explain how this regex works?

Cheers,
Dan

Answer 1

Basically when you dealing with user-submitted data you cannot be aware enough. Imo putting the regex check into the JavaScript area is a bad idea or not enough. You should be sure about you filter these kind of data everywhere (and sufficiently).

Common filtering rules that apply:

• Control user input as much as you can (predefined variables, auto-suggest, etc.)
• Filter out any unwanted input like html/script tags with strip_tags.
• Use prepared statements or try to be familiar with PDO for example
• At least use mysql_real_escape_string before inserting to your database