Re: What chars are considered safe?

From: Chung Leong (chernyshevsky_at_hotmail.com)
Date: 02/28/05 

Date: Mon, 28 Feb 2005 12:49:02 -0500

"Derek Fountain" <nospam@example.com> wrote in message
news:4222625c$0$4768$5a62ac22@per-qv1-newsreader-01.iinet.net.au...
> I was just writing a sanitisation route for a bit of user input. The data
is
> an English text description of a product, and will go into a DB, then back
> out to other user's browsers.
>
> As per normal practise, I was working on the basis of leaving in all
> characters that I considered safe and stripping out everything else. This
> led me to think of what characters are actually safe, given that the user
> will want to be able to use at least basic punctuation, currency symbols
> and so on. Avoiding < and > seemed obvious, but most other things have a
> use I think.
>
> My current line looks like this:
>
> $data = preg_replace( '/[^\s\w\d@"\'()[]{}:#~!$%&*_-+.,]/', "", $data );
>
> (Note that's a list of chars that are *not* to be replaced.) Are any of
> these dangerous? Or have I left out some that are harmless and should be
in
> there?

What encoding are you using? None of the characters above (maybe except 255)
is special, so I think can be safely included. People like to have their
curly quotes and m-dashes.

Relevant Pages

  • What chars are considered safe?
    ... I was just writing a sanitisation route for a bit of user input. ... an English text description of a product, and will go into a DB, then back ... characters that I considered safe and stripping out everything else. ...
    (comp.lang.php)
  • Ignore F1-F12 keys when user enters text input on console
    ... The user input it taken using STDIN.getc. ... the entered characters are not displayed and each character is ... obscured by displaying an asterix. ... def TestFunc ...
    (comp.lang.ruby)
  • Re: [Full-Disclosure] How T-Mobils network was compromised
    ... User input is passed to a function which sanitizes the input by ... converting "dangerous" characters to HTML representations. ... Function is flawless from a programming perspective and performs as ... should have occurred is a check for "../" in a loop. ...
    (Full-Disclosure)
  • avoid which characters in text fields with vb- and jscript?
    ... native win2k3 srv/xp clients environment on our IIS 6.0 intranet ... Have made various tables storing user input, ... sure to clean user inputs for unwanted characters before storing in ... Using the vbscript Replace funktion Im able to remove quotes ...
    (microsoft.public.scripting.vbscript)
  • how to get rid of trailing blank space in JTextField
    ... My problem is not how to restrict user input to JTextField to a fixed ... length as the column of characters I entered. ... and I can see that the textField does shrink a little bit compare to ...
    (comp.lang.java.gui)