php-and-mysql

Using Regular Expressions

Understanding the Three Regular Expression Command Sets
Defining Basic Patterns
Using "preg_match" for Form Validation
Finding All Matches with "preg_match_all"
Using "preg_replace" for Intelligent Search and Replace
LAB: Using Regular Expressions to Validate Form Data

LAB: Using Regular Expressions to Validate Form Data

What is the purpose of the lab?

Validation plays a critical role in the development of a website. Improperly validated data collected from a form can corrupt your database and can also pose an extreme security risk. The purpose of the lab is to demonstrate how regular expressions can be used to validate the new members signup form
Test form posting ...
- In your editor open sweetscomplete/addmember.php
- Add the following HTML attributes inside the <form> tag as follows:
  - action="addmember.php"
  - method="POST"
- Notice that form <input> elements are named "data[xxx]"
- Add to the top of the file:
```
if (isset($_POST["data"])) var_dump($_POST);
```
- From your browser open http://localhost/sweetscomplete/addmember.php
- Fill in some test data and click "Submit"
- Note that the data appears in $_POST under an array "data"
- Also note that the data in the form is cleared
Modify the form to "re-display" data ...
- At the top of the file assign $data = $_POST["data"]
- Set defaults if $_POST["data"] is not set
- Inside each <input> tag add the following:
```
value="<?php echo $data["xxx"]; ?>
```
  where "xxx" is the "name" key
- Fill in some test data and click "Submit"
- Notice that the data in the form is now retained
Filter the data ...
- Before validation, as a general rule, it is a good idea to filter the input
- This prevents any unwanted HTML tags from getting inserted into the data
- At the top of the code add a "foreach($data as $key => $value)" loop
- Inside the loop use "strip_tags()" to filter each $value
Validate the data ...
- Examine each input element and determine the nature of the data
- Design a regular expression pattern which matches each one
- After the "foreach()" loop add an "if ()" statements to match each element
- Use "preg_match()" to check the element against its pattern
- If the match fails, add an error message to $errors["xxx"] where "xxx" = the element name
- Echo the error message after each input element
- Try entering both good and bad values to test
Update the links between files ...
- Update the links between pages
- "Home" should be "index.php", "Products" should be "products.php" etc.

+ o -

Using Regular Expressions

Understanding the Three Regular Expression Command Sets

Defining Basic Patterns

Using "preg_match" for Form Validation

Finding All Matches with "preg_match_all"

Using "preg_replace" for Intelligent Search and Replace

LAB: Using Regular Expressions to Validate Form Data

Understanding the Three Regular Expression Command Sets

What is a regular expression?

A regular expression uses a set of pre-defined symbols to describe a string

What use is a regular expression in designing a website?

Regular expressions can be used to validate information which comes from an "untrustworthy" source. Regular expressions can also be used to extract information out of web documents and to perform "clean up"

What is validation?

Validation is the process of verifying that information is in the expected format and "follows the rules"

What are the families of regular expression commands?

ereg*, mb_ereg*, and preg* All three rely on different PHP extensions

Why is the preg* family recommended for use?

The ereg* family has been "deprecated" (obsolete -- scheduled to be removed from the PHP language). mb_ereg is based on the ereg* family, and is therefore also obsolete, but it supports multi-byte strings. The preg* family is being actively developed and supported.

Can you use the preg* family for multi-byte strings?

When you add the "u" modifier at the end of the pattern (another lesson), the preg* family supports UTF-8 encoded multi-byte strings

What is a multi-byte string?

A multi-byte string occupies more than one byte when stored, and is used to represent any international character set including Chinese, Thai, Arabic, etc.

Is there a performance disadvantage when using regular expressions?

Yes! If you only need to know character types, consider using the ctype* family instead. If the string you are searching for does not change, use "strpos()" or "stripos()"

Defining Basic Patterns

What is a "pattern"?

A pattern is a string which is used to describe a string

What is the purpose of defining a pattern?

You need to define a pattern in order to tell PHP what you are searching for

What pattern would find a word in a sentence?

/word/ or /word/i

How about a list of words?

/word1|word2|word3|etc/

What pattern searches from the beginning or end?

/^beginning/ or /ending$/

How about searching for letters or numbers?

/[A-Z]/ or /\w/ or /[0-9]/ or /\d/

Can a pattern search for an exact number of letters or numbers?

/[0-9]{5}/ = 5 numbers

What about support for international characters?

/international/u

Using "preg_match" for Form Validation

How does preg_match() work?

preg_match("/pattern/", $string) returns T or F and stops after the first match

Why use preg_match()?

preg_match() is used when you only need to verify or validate information, where the information has a complex format (e.g. validating a postal code or phone number)

How can you use preg_match() to validate form data?

1. Determine the nature of the data and the "rules" 2. Construct the appropriate pattern 3. if (preg_match("/pattern/", $user_data)) { // code if match; } else { // code if no match; }

Finding All Matches with "preg_match_all"

What does "preg_match_all" do?

"preg_match_all" locates all occurrences which match the pattern

Why would you want to use "preg_match_all"?

"preg_match_all" is useful for extracting information from websites

What is the difference between "preg_match" and "preg_match_all"?

"preg_match" stops after the first match. "preg_match_all" finds all possible matches.

When should you use "preg_match_all" rather than "preg_match"?

Use "preg_match" if you only need to know if it is a match TRUE or FALSE. Because "preg_match" stops after the first match, it is quicker. Use "preg_match_all" if you want to scan a website for information

Using "preg_replace" for Intelligent Search and Replace

What is meant by "search and replace"?

Search is when you search for a match in a string. Replace is the process of removing the original word or phrase, and replacing it with the new one.

Why would you want to use "preg_replace"?

Reformatting: switching words or phrases around inside a string Cleanup: replacing unwanted words with something else

LAB: Using Regular Expressions to Validate Form Data

What is the purpose of the lab?

Test form posting ...

Modify the form to "re-display" data ...

At the top of the file assign $data = $_POST["data"]Set defaults if $_POST["data"] is not setInside each <input> tag add the following:value="<?php echo $data["xxx"]; ?> where "xxx" is the "name" keyFill in some test data and click "Submit"Notice that the data in the form is now retained

Filter the data ...

Before validation, as a general rule, it is a good idea to filter the inputThis prevents any unwanted HTML tags from getting inserted into the dataAt the top of the code add a "foreach($data as $key => $value)" loopInside the loop use "strip_tags()" to filter each $value

Validate the data ...

Update the links between files ...

Update the links between pages"Home" should be "index.php", "Products" should be "products.php" etc.

Regular expressions can be used to validate information which comes from an "untrustworthy" source.
Regular expressions can also be used to extract information out of web documents and to perform "clean up"

ereg, mb_ereg, and preg*
All three rely on different PHP extensions

The ereg* family has been "deprecated" (obsolete -- scheduled to be removed from the PHP language).
mb_ereg is based on the ereg* family, and is therefore also obsolete, but it supports multi-byte strings.
The preg* family is being actively developed and supported.

When you add the "u" modifier at the end of the pattern (another lesson),
the preg* family supports UTF-8 encoded multi-byte strings

A multi-byte string occupies more than one byte when stored, and is used to represent
any international character set including Chinese, Thai, Arabic, etc.

Yes! If you only need to know character types, consider using the ctype* family instead.
If the string you are searching for does not change, use "strpos()" or "stripos()"

preg_match() is used when you only need to verify or validate information,
where the information has a complex format (e.g. validating a postal code or phone number)

1. Determine the nature of the data and the "rules"
2. Construct the appropriate pattern
3. if (preg_match("/pattern/", $user_data)) { // code if match; } else { // code if no match; }

"preg_match" stops after the first match.
"preg_match_all" finds all possible matches.

Use "preg_match" if you only need to know if it is a match TRUE or FALSE.
Because "preg_match" stops after the first match, it is quicker.
Use "preg_match_all" if you want to scan a website for information

Search is when you search for a match in a string.
Replace is the process of removing the original word or phrase, and replacing it with the new one.

Reformatting: switching words or phrases around inside a string
Cleanup: replacing unwanted words with something else

At the top of the file assign $data = $_POST["data"]
Set defaults if $_POST["data"] is not set
Inside each <input> tag add the following:
value="<?php echo $data["xxx"]; ?>
where "xxx" is the "name" key
Fill in some test data and click "Submit"
Notice that the data in the form is now retained

Before validation, as a general rule, it is a good idea to filter the input
This prevents any unwanted HTML tags from getting inserted into the data
At the top of the code add a "foreach($data as $key => $value)" loop
Inside the loop use "strip_tags()" to filter each $value

Update the links between pages
"Home" should be "index.php", "Products" should be "products.php" etc.