ereg_replace question

[vexx]

I have the following lines of code:

 

$title =ereg_replace("[^[:alnum:]]", " ", $_POST['title']);

$title = ereg_replace(" +",' ',$title);

 

Any inputed title will be shown, except for the special chars. My question is, how can I allow the following chars: ' and -

 

Tnx in advance.

 

p.s. i'm a newbie programmer

[effigy]

[^[:alnum:]'-] I think

[vexx]

r u sure?..not working it seems

[effigy]

Works for me:

<pre>
<?php
echo ereg_replace("[^[:alnum:]'-]", ' ', "abc123.,:'-");
?>
</pre>

abc123  '-

[vexx]

on - is working, but when i try to add ' it gives me the following error "supplied argument is not a valid MySQL result resource". So, the ' char is not working, maybe i did something wrong?

 

I edited the lines like this:

 

$title =ereg_replace("[^[:alnum:]'-]", " ", $_POST['title']);
$title = ereg_replace(" +",' ',$title);

[vexx]

on - is working, but when i try to add ' it gives me the following error "supplied argument is not a valid MySQL result resource". So, the ' char is not working, maybe i did something wrong?

 

I edited the lines like this:

 

$title =ereg_replace("[^[:alnum:]'-]", " ", $_POST['title']);
$title = ereg_replace(" +",' ',$title);

 

ok,i resolved the ' problem by editiing this line:

$title = ereg_replace(" +'",' ',$title);

 

the problem is now, that ' doesn't appear tho...only -

[effigy]

If you're leaving quotes in $title then using it within SQL, you need to use mysql_real_escape_string.

[vexx]

no, I don't use quotes in title, the only char i need is ' ..but i hope i didn't got your message wrong now

[vexx]

somebody advised me to use pre_replace:

 

$title = preg_replace('/[^\w\' -]/', ' ', $_POST['title'] );
$title = preg_replace('/ +/', ' ', $title);

 

The problem is, while - is showing with no problem, the ' is not.

 

example of titles used: test'ing, test-test

 

test-test shows very good, while test'ing isn't even displayed

[aCa]

Hmm I tryed you preg_replace in my regex test tool and for me the test'ing worked fine...

 

But as effigy said. Since you are accepting ' then you need to do mysql_real_escape_string before you post to database becouse the ' will break the SQL.

[vexx]

ok,i figured it out, it wasn't escaped, so it works:

 

$title = preg_replace('/[^\w\'-]/', ' ', $_POST['title']);

$title = preg_replace('/ +/', ' ', $title);

$title = mysql_real_escape_string($title); 

 

Now, the only problem is, when i type any title with ' in it, it ads a space before for no reason like this: Test 'ing instead of Test'ing

 

why?