Before saving the input from users in the database, I am using the below function to replace all HTML special chars. All my users will always be using the English Language.
Option 1
function clean($var) {
$regEx="/[^a-zA-Z0-9 -_]/";
$var = preg_replace($regEx, "", $var);
return $var;
}
I want users to be able to only store
- Letters (a to z) (Case Insensitive)
- Numbers (0 to 9)
- Space, Dash, Underscore
Will the above function is good for this job, or should I be using a more efficient/inbuilt function in PHP?
This is how I am using the function.
$userInput = htmlspecialchars(clean($userInput));
Option 2
function h($str_to_encode = ""){
// Pregmatch will replacte all HTML characters with Empty string
return preg_replace("/&#?[a-z0-9]{2,8};/i","", htmlspecialchars($str_to_encode));
}
Regex from : https://stackoverflow.com/a/657670/4050261
a-z
are valid. Take a look at this: English words with diacritics. \$\endgroup\$