DIG 3134 – Lecture 10: Regular Expressions and preg_match in PHP and Validating Inputs

Please download to get full document.

View again

of 46
4 views
All materials on our website are shared by users. If you have any questions about copyright issues, please report us to resolve them. We are always happy to assist you.

Download

Document Related
Document Description
Internet Software Design. DIG 3134 – Lecture 10: Regular Expressions and preg_match in PHP and Validating Inputs Michael Moshell University of Central Florida. Part 1: Regular Expressions. A "grammar" for validating input useful for many kinds of pattern recognition
Document Share
Document Transcript
Internet Software DesignDIG 3134 – Lecture 10:Regular Expressions and preg_matchin PHPandValidating InputsMichael MoshellUniversity of Central FloridaPart 1: Regular Expressions
  • A "grammar" for validating input
  • useful for many kinds of pattern recognition
  • The basic built-in Boolean function is called 'preg_match'.
  • It takes two or three arguments:
  • the pattern, like "cat"
  • the test string, like "catastrophe"
  • and an (optional) array variable,
  • which we can ignore for now
  • It returns TRUE if the pattern matches the test string.
  • Regular Expressions
  • Note; There is also a perl based regular expression
  • system in PHP called ereg. I used it for years.
  • But it is now DEPRECATED**
  • So we will use preg_match in this course
  • from now on.
  • ** BONUS for those who attended today's lecture:
  • Definition of DEPRECATED.
  • Regular Expressions$instring = "catastrophe";if (preg_match("/cat/",$instring)){ print "I found a cat!";}else{ print "No cat here.";}Regular Expressions$instring = "catastrophe";if (preg_match("/cat/",$instring)){ print "I found a cat!";}else{ print "No cat here.";}I found a cat!Regular ExpressionsWild cards: period . matches any character$instring = "cotastrophe";if (preg_match("/c.t/",$instring)){ print "I found a c.t!";}else{ print "No c.t here.";}Regular ExpressionsWild cards: period . matches any character$instring = "cotastrophe";if (preg_match("/c.t/",$instring)){ print "I found a c.t!";}else{ print "No c.t here.";}I found a c.t!Regular ExpressionsWild cards: .* matches any string of characters (or the "null character"!)$instring = "cotastrophe";if (preg_match("/c.*t/",$instring)){ print "I found a c.*t!";}else{ print "No c*t here.";}Regular ExpressionsWild cards: .* matches any string of characters (or the "null character"!)$instring = "cotastrophe";if (preg_match("/c.*t/",$instring)){ print "I found a c.*t!";}else{ print "No c*t here.";}I found a c.*t!Regular ExpressionsWild cards: * matches any string of characters (or the "null character"!)$instring = "cflippingmonstroustastrophe";if (preg_match("/c.*t/",$instring)){ print "I found a c.*t!";}else{ print "No c.*t here.";}Regular ExpressionsWild cards: * matches any string of characters (or the "null character"!)$instring = "cflippingmonstroustastrophe";if (preg_match("/c*t/",$instring)){ print "I found a c.*t!";}else{ print "No c.*t here.";}I found a c.*t!QuantificationMultiple copies of something:a+ means ONE OR MORE a’sa* means ZERO OR MORE a’sa? means ZERO OR ONE aa{33} means 33 instances of aEscapingBackslash means "don't interpret this:"\. is just a dot\* is just an asterisk.The concept:Would$t="/a{3}\.b{1,4}/";$s= "aaa.bbb"; this would or would not be accepted? preg_match($t,$s) – true or false?The concept:Would$t="/a{3}\.b{1,4}/";$s= "aaa.bbb"; this would or would not be accepted? preg_match($t,$s) – true or false?TRUE, because $s matches the pattern string $t.three a, one dot, and between one and four b characters.The concept:Would$t="/a{3}\.b{1,4}/";$s= "aaa.bbbbb"; this would or would not be accepted? preg_match($t,$s) – true or false?The concept:Would$t="a{3}\.b{1,4} ";$s= "aaa.bbbbb"; this would or would not be accepted? preg_match($t,$s) – true or false?TRUE, because there ARE indeed 3 a, a dot, 4 b.(Yes, there are MORE than 4b, but so what?)As soon as a match is found, the preg_match returns TRUE without examining the rest of the string $s.GroupingMultiple copies of something:(abc)+ means ONE OR MORE string abc’s(abc)* means ZERO OR MORE string abc’slike abcabcabcSETS:[0-9] matches any single integer character[A-Z] matches any uppercase letter[AZ] matches A or Z[AZ]? matches null, A or Za{3}\.b{1,4} matches 3 a’s, a dot, and one to 4 b’s.Starting and Endingpreg_match("/cat/","abunchofcats") is TRUEbutpreg_match("/^cat/","abunchofcats") is FALSEbecause ^ means "must match the first letter.preg_match("/cats$/","abunchofcats") is TRUEbutpreg_match("/cats$/","mycatsarelazy") is FALSESo, ^ marks the head and $ marks the tail, for preg_match.Sets - Examples[A-E]{3} matches AAA, ABA, ADD, ... EEE[PQX]{2,4} matches PP, PQ, PX ... up to XXXXPracticeWrite a RE that recognizes any string that begins with"sale".Here's an example for you to look at, help you rememberpreg_match("/^cat/",$teststring)Practice1) Write a RE that recognizes any string that begins with"sale".Answer: preg_match("/^sale/",$teststring)Practice1) Write a RE that recognizes any string that begins with"sale".Answer: preg_match("^sale",$teststring)2) Write a RE that recognizes a string that begins with"smith" and a two digit integer, like smith23 or smith99.Here's an example from your recent past: a{3}\.b{1,4}Practice1) Write a RE that recognizes any string that begins with"sale".Answer: preg_match("/^sale/",$teststring)2) Write a RE that recognizes a string that begins with"smith" and a two digit integer, like smith23 or smith99.Answer: preg_match("/^smith[0-9]{2}/",$teststring)Sucking Data from a StringNow it gets REALLY useful.Let's say we have an input like smith23 or jones99; could be ANY name and ANY number. we want to split it into the name and the number. Here's howpreg_match("/^[a-zA-Z]+[0-9]+/",$reg) – this would recognize the pattern, right? (Including roBert, etc.)if ( preg_match("/ (^[a-zA-Z]+)([0-9]+)/",$in, $reg)) { $name=$reg[1]; $number=$reg[2]; .. // etc $wholething=$reg[0]; }Sucking Data from a StringNow it gets REALLY useful.Let's say we have an input like smith23 or jones99; could be ANY name and ANY number. we want to split it into the name and the number. Here's howpreg_match("/^[a-zA-Z]+[0-9]+/",$reg) – this would recognize the pattern, right? (Including roBert, etc.)if ( preg_match("/ (^[a-zA-Z]+)([0-9]+)/",$in, $reg)) { $name=$reg[1]; $number=$reg[2]; .. // etc }ArrayPractice Problems1) Write a function that - prints "Good zip code" if the input is of the form 77889 (five integers); - prints "Great zip code" if the input is of the form 33445-9999 (five integers, a dash and four integers) - prints "Is that foreign?" for all other possible values.1) Write a function that - prints "Good zip code" if the input is of the form 77889 (five integers); - prints "Great zip code" if the input is of the form 33445-9999 (five integers, a dash and four integers) - prints "Is that foreign?" for all other possible values.function ziptest($input){ if (preg_match("/^[0-9]{5}\-[0-9]{4}$/",$input)) print "Great zip code"; else if (preg_match("/^[0-9]{5}$/",$input)) print "Good zip code"; else print "Is that foreign?";} #end ziptest2) Write a function that returns the five digit part of any valid zipcode presented, as described above; and returns "invalid" if no zipcode was found in either of the two legal formats.2) Write a function that returns the five digit part of any valid zipcode presented, as described above; and returns "invalid" if no zipcode was found in either of the two legal formats.function zipchopper($input){ if (preg_match("/^([0-9]{5})\-([0-9]{4})$/",$input,$reg)) return $reg[1]; else if (preg_match("/^([0-9]{5})$/",$input,$reg)) return $reg[1]; else return "invalid";} #end zipchopperprint zipchopper("32766-0041"); // this returns 32766print zipchopper("32766"); // this returns 32766print zipchopper("32766-"); // this returns "invalid"print zipchopper("3276"); // this returns "invalid"print zipchopper("snortwoggle"); // this returns "invalid"30Here's a MIDTERM EXAM PRACTICE PROBLEM2) Write a function that returns the five digit part of any valid zipcode presented, as described above. If we refer to the input as X, the function returns and returns "X is invalid" if no zipcode was found in either of the two legal formats. If a valid input of type 1 is found (the 5 plus 4) then the function returns "X is type 1 valid". If a valid input of type 2 is found (just 5 digits) then the function returns "X is type 2 valid".print zipchopper("32766-0041"); // this returns "32766-0041 is type 1 valid".print zipchopper("32766"); // this returns 32766 is type 2 valid.print zipchopper("32766-"); // this returns "32766- is invalid"print zipchopper("3276"); // this returns "3276 is invalid"print zipchopper("snortwoggle"); // this returns "snortwoggle is invalid"Part 2: Validationlpmpjogja.diknas.go.id
  • Validation means checking to see if inputs are correct
  • and providing corrective feedback if they are not.
  • MISSING: Required inputs that are not provided
  • OUT OF RANGE: out of specified upper/lower limits
  • FORMAT: Input data is not formatted correctly
  • PATTERN: Input doesn't match a secret pattern
  • MATCH LIST: Input doesn't match a stored list
  • INCONSISTENT: Inputs don't fit together.
  • And -- here are many more ways to be wrong ...
  • Missing Data$firstname=$_POST['firstname'];if (!$firstname){ $report.="<li>Please provide your first name.</li>";}// do the same for last name, all other required inputs.if ($report) { print "Please fix these errors:<ul>$report</ul>"; exit; // ends execution here.(Should print </html> etc); }else { // process the inputs normally }psychologytoday.comOut of range$age=$_POST['age'];if ($age<0) // anything here acts like TRUE. { // an empty variable acts like FALSE. $response.="<li>Are you really $age years old?</li>"; }// do the same for $age>100, and any other inputs.if ($response) { print "Please fix these errors:<ul>$response</ul>";}else { // process the inputs normally }www.vrazvedka.ruWrong FormatSocial Security Numbers: 333-44-6789if (!preg_match("/^[0-9]{3}\-[0-9]{2}\-[0-9]{4}/",$tryssn)){ do your error thang ...}ButSometimes you can tolerate bad formats.but if it's got nine digits, maybe it's right.$cleanssn=preg_replace('/[^0-9]/','',$tryssn);www.pagetutor.comAny charnot in [0-9]is replacedby an empty string(that is, twoquotes withno space.)A brief commercial interruption$output=preg_replace($pattern,$replacement,$input);-- is a MOST AWESOME FUNCTION(read all about it…. It can do magic if you use arraysFor the $pattern or the $replacement or both.)www.dreamstime.com36Wrong FormatSocial Security Numbers: 333-44-6789if (!preg_match("^[0-9]{3}\-[0-9]{2}\-[0-9]{4}",$tryssn)){ do your error thang ...}ButSometimes you can tolerate bad formats.but if it's got nine digits, maybe it's right.$cleanssn=preg_replace('/[^0-9]/','',$tryssn);www.pagetutor.comAny charnot in [0-9]is replacedby an empty string(that is, twoquotes withno space.)UNfortunately, ^ inside the [ ] means NOT,but ^outside the [ ] means 'at the beginning. Wrong FormatSocial Security Numbers: 333-44-6789if (!preg_match("^[0-9]{3}\-[0-9]{2}\-[0-9]{4}",$tryssn)){ // do yo error thang ...}ButSometimes you can tolerate bad formats.but if it's got nine digits, maybe it's right.$cleanssn=preg_replace('/[^0-9]/','',$tryssn);if (strlen($cleanssn)!=9) { // do yo error thing again ... }www.pagetutor.comAny charnot in [0-9]is replacedby an empty string(that is, twoquotes withno space.)PatternEnter your promotion code:$testcode=$_POST['testcode'];if (!preg_match("/^Woody[0-9]{4}/",$testcode)){ $reply="Sorry, that code was not accepted.";} else { //do you acceptance thing .. give them the discount. }www.bannersplus.comMatch List – e. g. a raffleThis is just like the password problem. VERSION 1: short lists $try=$_POST['tryinput']; $good['Samclub']=100; $good['Samfriend']=50; $good['Samwitch']=25; $prize=($good[$try]); if ($prize) { $result="Congrats! You have won $$prize."; } else { // do whatever you want with this loser }www.inspectamerica.comMatch List – e. g. a raffleVersion 2: Long (and changing) lists. Use a DB!$try=$_POST['tryinput'];$q="SELECT * FROM checklist WHERE checkval='$try' ";$result=mysql_query($q,$connection);if ($result){ $row=mysql_fetch_array($result) $prize=$row[1]; $result="Congrats! You have won $$prize.";} else{ // do whatever you want with this loser }www.inspectamerica.com>> MAJOR WARNING <<This example contains a NO – NO.$try=$_POST['tryinput'];$q="SELECT * FROM checklist WHERE checkval='$try' ";$result=mysql_query($q,$connection);NOTE: DO NOT TRY THIS AT HOME** because it can be the victim of anSQL INJECTION ATTACK (see Security Lecture)www.chiomega.com42>> MAJOR WARNING <<If you gotta try it sooner, here's the prophylactic:$try=$_POST['tryinput'];$try=mysql_real_escape_string($try);$q="SELECT * FROM checklist WHERE checkval='$try' ";$result=mysql_query($q,$connection);This will protect your code from anSQL INJECTION ATTACKWeb.ics.purdue.edu4343ConsistencyI am a member of the Meatball Fraternity Member Number meattruck.com$checkin=$_POST['checkin']; $memnum=$_POST['memnum'];if ($checkin && !$memnum){ $report.='Please provide your member number.';}if (!$checkin && $memnum){ $report.='You did not check the membership box.';}if ($checkin && $memnum) $ismember=1;if ($report) { // do the error thing }A basic decision about validation:OPTION 1: One error ends scanvsOPTION 2: Report all the errors on the current pageTo do the 'all errors' technique, accumulate your messagesin a $results variable, then print the messages all at once.Where we are not going in this course:"Instant validation" – Javascript and AJAX. It's spiffy but it is hard to maintain and extend. Javascript - does all the work in the client. AJAX – the Javascript gets help from the server.What should you do about validation?*** Any input on Project 2, 3 or 4 that can be validated, SHOULD BE. (Brag about it, so I'll test it!!)*** There will be questions about validation on the midterm exam.SO ... practice with Regular Expressions and TEST them using WAMP or MAMP and DEBUG them if they don't work.
    Search Related
    We Need Your Support
    Thank you for visiting our website and your interest in our free products and services. We are nonprofit website to share and download documents. To the running of this website, we need your help to support us.

    Thanks to everyone for your continued support.

    No, Thanks