Webcodez - The database of web programming tutorials » preg_match

User Input Validation (Part 2) Examples

admin — Mon, 01 Feb 2010 10:26:01 +0000

In the previous tutorial on user input validation the basics about user input validation were explained. This tutorial will require you to have a basic knowledge about user input validations (php patterns), if you don’t know about php patterns yet I’d advice you to first have a look at the previous tutorial about user input validation. In this tutorial a couple of examples of user input validation patterns will be given and explained. The patterns explained in this tutorial are for: email and website address (url) user input validations.

Use of all patterns

All patterns explained in this tutorial can be used by using the preg_match function, for example using an if loop:

//$value = $_POST['input_field_name']; for example
if(preg_match("/pattern/", $value))
   //matched
else
  //did not match

Email Validation

To validate a user input for an email, to check whether it’s a valid email, can be done in several ways. Here I’ll be showing 2 ways to validate an email. To create a pattern for validating an email you’ll first need to think of how an email can look like ( structure ). Which is:

email_name@email_provider.lang

Where ‘lang’ can be anything like: com or net or nl ( dutch ), etc.. The ‘email_name’ can be anything of any length containing alphabetical characters, numbers or the – _ symbols. Same goes for the ‘email_provider’. So for validating USA email addresses (.com) for example, we could have a pattern like this:

Pattern:

/^[A-Za-z0-9-_.]*@[A-Za-z0-9-_.]*(\.com)$/

However this pattern will only allow/match email addresses that end with .com. We could use the | seperator to allow several ‘extensions’ for the email ( .com OR .net OR .nl, etc..). That would look like this:

Pattern:

/^[A-Za-z0-9-_.]*@[A-Za-z0-9-_.]*(\.com|\.net|\.nl|\.de|\.be|\.co\.uk)$/

And you could add all extensions you want to allow for the email address there, seperated by | and don’t forget to escape the dots (.) with a backslash (\) so it will be treated as a normal character.

Note: a second way to do this could be to allow all extensions (.com, .net or .anythinghere). To do this just replace the \.com|\.net|etc… by \.[A-Za-z0-9]* which basicly means: all alphabetical characters and numbers.

Example of use:

 Valid email: {$email} ";

}else{

    echo " Invalid email: {$email} ";

}

$email = "invalid' email@invalid,provider}.fpweo";

if(preg_match("/^[A-Za-z0-9-_.]*@[A-Za-z0-9-_.]*(\.com|\.net|\.nl|\.de|\.be|\.co\.uk)$/", $email)) {

    echo " Valid email: {$email} ";

}else{

    echo " Invalid email: {$email} ";

}

?>

Output:

Valid Email: validemail123@validprovider_09.net

Invalid Email: invalid’ email@invalid,provider}.fpweo

Website Address Validation

For creating a pattern to validate website adresses (urls) we’ll have a look at a valid structure of a website address first, which is similar to:

http(s)://(www. or subdomain.)websitename.com(/directories)(/page.ext)(?getvar&getvars)

Where what’s between brackets is optionally. The .com can be any other ‘extension’ of course (.net or .co.uk, etc.).

Pattern:

/^(http)(s)?(:\/\/)(www\.|[A-Za-z0-9_-]*\.)?[A-Za-z0-9_-]*(\.com|\.net|\.co\.uk|\.net)(\/|\/[A-Za-z0-9-_ .]*)*$/

This is just an example of a pattern I created that could be used. It may at first look complex but it isn’t that complex at all if you have a further look into it. Let’s go through it briefly. Each valid website address starts with ‘http’ (^(http)) followed by an optional ’s’ ( (s)? ). After that there’s a ‘://’ which is put inside the pattern as (:\/\/) as all /s need to be escaped by a \. So // becomes \/\/. Then there’s an optional ( so a ? behind the collection ) ‘www.’ or ’subdomain_name.’ where the subdomain_name can be any alphabetical character or number or _ or – ([A-Za-z0-9_-]) and any size (* = any amount of characters). The question mark behind this collection ( www. | subdomain. ) defines it may occur one or zero times (that it’s optional). Then there’s again the [A-za-z0-9_-] which again means any alphabetical characters or numbers or the _ or – symbol, which is for the domainname of the website which may contain any of these characters in any length (*). Then it should be followed by any of these ‘extensions’ ( \.com|\.net|\.co\.uk|\.net ). Now the rest of the pattern is optional – there can be anything after the url (after a backslash / ).

Example of use:

 Valid url: {$url} ";

}else{

    echo " Invalid url: {$url} ";

}

$url = "http://invalidurl-^.";

if(preg_match("/^(http)(s)?(:\/\/)(www\.|[A-Za-z0-9_-]*\.)?[A-Za-z0-9_-]*(\.com|\.net|\.co\.uk|\.net)(\/|\/[A-Za-z0-9-_ .]*)*$/", $url)) {

    echo " Valid Url: {$url} ";

}else{

    echo " Invalid Url: {$url} ";

}

?>

Output:

Valid Url: http://www.validurl.net/anypath/anyfile.php?anything

Invalid Url: http://invalidurl-^.

Note: To only allow domain names website addresses without any paths behind it ( like: http://www.google.com ) remove the last part of the pattern between brackets followed by a * ( which is: (\/|\/[A-Za-z0-9-_ .]*)* ) or replace it by (\/)? if you do want to allow a possible ending backslash ( http://www.google.com/ ).

User Input Validation (Part 1)

admin — Mon, 25 Jan 2010 15:10:08 +0000

Beside securing user input data it’s also important to validate the user input data. For example when you require the user to fill in his/her email, you do want it to be a real email address. To be more sure about this, you can use certain PHP functions to validate the user input to be a valid email address. In this tutorial we’ll be using the preg_match function to do this. The use of this function and the creation of patterns to validate user input will be explained. Actually retrieving user input from forms won’t be explained in this tutorial, only the validation process of user input using patterns and preg_match, will be explained. For retrieving the user input from forms, please take a look at the 3rd part of this tutorial.

Preg_match Function

The preg_match function basicly checks whether a value matches the given pattern. A pattern sets the characters that the value may contain and in which order they may occur in the value and how many times. Let’s start with the preg_match function itself:

preg_match(‘/pattern/’, ‘value’);

The pattern always needs to be put between backslashes ( / … pattern here … / ). The value would be for example the user input.

Using preg_match

There are several ways to use the preg_match function. In this tutorial we’ll be using it to validate values ( user input ) using pattern. Therefore we’ll put the preg_match function inside an if loop. This is how it looks like:

if( preg_match(‘/pattern/’, ‘value’) ) {

//the value matched the pattern

}

This basicly just executes the preg_match function which returns TRUE when a match was found in the value with the pattern given.

Creating Patterns

So how do patterns look like and how do we create them? Patterns can sometimes look quite complex but usually they aren’t that complicated as they may look like. PHP uses specific symbols that can be used inside a pattern. They can be divided into 3 types: symbols that indicate the position of a character in the value, the kind of character and how many of this character the value may contain.

Symbols

Position

^(…some character …) – character (set) must be found at the beginning of the value matched
$(…some character…) – character (set) must be found at the end of the value matched

Characters

. – Any character
[A-Za-z0-9] – All non-capital and capital alphabetical characters and all numbers

Amounts
These symbols are put after the character it will be working for, for example: a* or 9+

* – character may occur any amount of times
+ – character may occur 1 or more times
? – character may occur 0 or 1 time
{1,2,3,9-11} – character may occur 1, 2, 3 or 9, 10, 11 times

Basic Pattern

Allright, now we can use any of these symbols to create our first basic pattern. Let’s create a few basic patterns and show some values that would match and some values that would not match the pattern. Let’s start creating a pattern that starts with any capital alphabetical character (A-Z) and ends with any number (0-9):

Pattern

/^[A-Z][0-9]$/

Matches

A9
Z2
R5

None Matches:

2V
AD2
F32

Allright, this pattern matches any value that starts with a capital alphabetical character and ends with a number. However it may only contain ONE of both ( as we didn’t set an amount, it means t may only occur onces ). So it must be one capital alphabetical character followed by one number.

Let’s edit this pattern to match a value starting with any amount of capital alphabetical characters and ending with any amount of numbers. We’ll use the * symbol to indicate that these characters and numbers sets may both occur any amount of times:

Pattern

/^[A-Z]*[0-9]*$/

Matches

JFL9
A837
S2
4
H

None Matches:

2V
8O3
AJK92K

Now we used the * symbol for both, to set that both (A-Z and 0-9) may occur any time. Which means 0 times is possible to. So it would as well match an empty value ( 0 times a capital character and 0 times a number ) or only 1 number or capital character. To require one of the charsets (A-Z or 0-9 for example) to occur atleast ONCE, you could use the + symbol instead of the *.

Pattern

/[A-Z][0-9]/

Matches

‘-)A4=
B9
+][L3

None Matches:

22
'[BB
{}-9A

Now we took our first pattern but removed the ^ and $. So now it doesn't matter WHERE in the value string these characters were found/matched. As we didn't set an amount for each charset ( [A-Z] and [0-9] ) it matches a value of a string which has once a capital letter ( A-Z ) and once a number ( 0-9 ) and in the same order as given in the pattern ( which is: letter number, for example: A9). The rest of the string it matches can have any characters in it. For example A9 matches the pattern, but it can be in any string, like: ‘[-=A9′;- would match as well as it will find the A9 which matches the pattern. As we didn’t set the ^ and $ – in that case the WHOLE string should match the pattern ( from beginning ( ^ ) to end ( $ )).

Using text inside patterns

It’s also possible to use text inside a pattern. Like searching for the word “hello” inside a string. This would be a simple pattern:

Pattern

/(hello)/

We put the text between brackets so it will search for the word between brackets. This pattern would match for example:

Matches

hello there!
are you there, hello?

However if we want to find the text ‘hello.’ (with a dot) and we create the pattern just like we did above, it won’t work the way we want it to. Because then it will see the dot as a symbol indicating any character as the dot is as well a standard symbol used for patterns in PHP. So to actually use the dot as a character, we’ll need to put a backslash before the dot so it will threat it as a character instead of a special pattern symbol.

Pattern

/(hello\.)/

Patterns that match several specific words or strings

In the previous examples above we made it match a specific word ( ‘hello’ as above, for example ). But we can also make it match several specific words/strings. So when any of the words set was found, it will return TRUE (matched). We’ll use a new symbol to do this: |

Pattern

/(word1|word2)/

The pattern above would match any value/string that either contains the word ‘word1′ OR ‘word2′. This way you could for example match image files by checking if the extension was any of the image extensions ( JPG, GIF, PNG, etc…).

Pattern

/(JPG|JPEG|GIF|BMP|PNG)$/

Matches

All values that end with either JPG, JPEG, GIF, BMP or PNG.

Conclusion

Patterns can be very usefully when it comes to validating user input data and I hope you learnt something with this tutorial. It can be used to for example validate emails, website urls, image file names and much more. But don’t worry, I’ll be posting tutorials on validating these specific data values soon if not already ( like emails, urls, … )!