For preg_match(), the pattern looks like this:
Code:
{delimiter} {pattern} {delimiter} {options}
I use #
as a delimiter because it's very rarely used in the pattern. Other good/common options are /
, ~
, @
, etc..
You might use
PHP Code:
<?php
function injection_chars( $s ){
// test for all characters at once by using "|" ("or").
return preg_match( '#\r|\n|%0a|%0d#',$s );
}
As an aside, there are other characters you might check for. Feed, vertical tab, and nonprintable characters.
I test for them separately (since I sometimes want to keep newlines, e.g., from textareas - after I standardize them all as \r\n
, of course). Here's the patterns I use:
PHP Code:
<?php
$REGEXP_newlines = '#([\n|\r|\f|\x0b|\x85|\x{2028}|\x{2029}]+)#u';
$REGEXP_nonprintable = '#[\x00-\x08\x0B\x0C\x0E-\x1F]#';
Bookmarks