URL character check

[hendry]

I am looking for a function that checks there isn't non-valid URL
characters in some input:

http://www.blooberry.com/indexdot/ht...rlencoding.htm

Not sure what happened to the % character here.

I am having trouble crafting the regular expression as of course:

if (preg_match("/[^a-zA-Z0-9$-_.+!*'(),]/", $uri))

doesn't work and no end of escaping seems to work.

[Alvaro G. Vicario]

*** hendry escribió/wrote (7 Dec 2005 17:46:44 -0800):

if (preg_match("/[^a-zA-Z0-9$-_.+!*'(),]/", $uri))

doesn't work and no end of escaping seems to work.

This means: given a list of all possible characters, return TRUE if $uri
contains a character not included in the list.

You must be aware that certain characters have a special meaning in regular
expressions, just like '*' has a special meaning in a Windows or Linux
directory listing. You need to escape them when they aren't special
characters.

http://www.php.net/manual/en/ref.pcre.php
http://www.php.net/manual/en/referen...ern.syntax.php
http://www.php.net/manual/en/referen....modifiers.php
--
-+ Álvaro G. Vicario - Burgos, Spain
++ http://bits.demogracia.com es mi sitio para programadores web
+- http://www.demogracia.com es mi web de humor libre de cloro
--

[hendry]

Yes and I do escape them and it doesn't work. *sigh* regex suck.

[Alvaro G. Vicario]

*** hendry escribió/wrote (8 Dec 2005 18:37:41 -0800):

Yes and I do escape them and it doesn't work. *sigh* regex suck.

If unsure about how to escape them, preg_quote() will do the trick
wonderfully.

--
-+ Álvaro G. Vicario - Burgos, Spain
++ http://bits.demogracia.com es mi sitio para programadores web
+- http://www.demogracia.com es mi web de humor libre de cloro
--

[jamen]

hendry wrote:

I am looking for a function that checks there isn't non-valid URL
characters in some input:

http://www.blooberry.com/indexdot/ht...rlencoding.htm

if (preg_match("/[^a-zA-Z0-9$-_.+!*'(),]/", $uri))

Remember that in a character class the hypen (-) character has a very
special meaning. So escape it, or move it to the front or back of the class:

$-_

Means all the characters between $ and _ including $ and _

And escape the $-character to be sure php doesn't try to parse it as a
variable

/[^a-zA-Z0-9\$_.+!*'(),-]/

[John Dunlop]

hendry wrote:

I am looking for a function that checks there isn't non-valid URL
characters in some input:
That's harder than you make out, even if your only concern is HTTP URLs,
because not all parts allow the same set of characters. For example, a
blanket ban on <?> because it can't occur in paths doesn't take into
account that it can occur in queries and fragments; likewise, a free pass
to digits because they can occur almost anywhere doesn't take into account
that they can't occur first in a scheme.

You'd have to, for starters, slice the URL into its components -
scheme, authority, path, etc. - before performing any checks, unless of
course your check is simply for characters that aren't allowed at all
(spaces, double quotes, and the like). Then, and I'm afraid there's no
getting around this, you'd have to examine the relevant sections of RFCs
3986 and 2616 to find out exactly what can go where.
http://www.blooberry.com/indexdot/ht...rlencoding.htm

(That page is long past its best-by. Burn that bookmark!)

--
Jock