Question

Updating someone else’s old PHP project and I’m unfamiliar with regular expressions.

Question one is: What does this do?

preg_match('/^[0-9]+[.]?[0-9]*$/', $variable)

Question two is: Is this a safe filter for insertion into a mysql DB without mysql_real_escape_string()? I know the answer is prob no, but it is set up to use mysql_real_escape_string() only if this regex doesn’t pass.

Thanks.

Answer 1

^      // start of string
[0-9]+ // one or more numbers (could also be \d+)
[.]?   // zero or one period (could also be \.?)
[0-9]* // zero or more numbers (could also be \d*)
$      //end of string

So, it makes sure the input is a number, such as 12 or 3.6 (52. will also match). It will not match .35 or 12a6.

It seems safe enough for DB insertion, because it only allows numbers.