Invalid if Special Character is entered

Question

I currently have this code below which validates username length only. If none entered it will show error message, if less than 3 characters entered show error message. I want to add an if/else statement that if the user enters special characters like !@#$%^&*()+=/? etc... the only special character is allowed is underscore (_) and hypen (-)... Help me how.

thanks

here's the code i have:

<?php
$serror="";
if (isset($_POST['submit'])) {              
    $username=$_POST['username'];
    $lengt = strlen($username);

    if($lengt == 0){
        $serror=" Please enter account username ";
    }
    else{
        if($lengt < 3 ){            
            $serror=" Please enter valid account username ";
        }
    }
    if($serror==""){
        ob_start();
        echo "Success";
        header("Location:progress.php?username=$username");
        exit;
        ob_end_flush();
    }
    else{}              
}
?>

you can use a regular expression to detect unwanted characters or only allow allowed characters — CodeToad, Jul 10 '16 at 14:05

score 0 · Answer 1 · answered Jul 10 '16 at 14:05

0

use preg_match() function

$yourString = "blahblah";
if (preg_match('/^[A-Za-z0-9_-]*$/', $yourString)) {
    #your string is good
}

remeber preg_match() returns boolean

answered Jul 10 '16 at 14:05

Ahmad ghoneim

844
7
13

That should work. This pattern should also work: `/^([\w\-]+)$/` – M. Eriksson Jul 10 '16 at 14:07

score 0 · Answer 2 · edited May 23 '17 at 11:51

0

Your php script works after the user submits the form. From your tags in the question I assume you can use javascript. With Javascript you catch these errors before the form is submitted.

So, your html input field would fire a script and you can use the onkeypress event to see the value of the keystroke.

The submit button would also have a javascript event to look for min string length, else give warning and not submit form.

edited May 23 '17 at 11:51

Community

1
1

answered Jul 10 '16 at 14:15

bluepinto

165
9

This is true, but you should always have validation in the back end as well. People are evil and JS can be manipulated. – M. Eriksson Jul 10 '16 at 14:21
1

very very true. But since his header is using `GET` method for username, I figured security isn't top priority. – bluepinto Jul 10 '16 at 14:25
Oh snap! I missed that one! – M. Eriksson Jul 10 '16 at 14:35

score 0 · Answer 3 · answered Jul 10 '16 at 14:30

0

As others already pointed out, you should use regular expressions for this.

Try with the following if-statement (allows a-z, numbers, underscores and hyphens). It also checks that the length is at least 3 characters:

if (!preg_match("/^([\w\-]{3,})$/", $username)) {
    $error = "Not enough chars or there are invalid ones".
}

Invalid if Special Character is entered

3 Answers3