[SOLVED] help me clean up code.. and sql error

[defeated]

Hi,

I am very very new to regex and would like to know how I can clean up the following:

$descriptiona = $_REQUEST['description2'] ;
$bad=array("<p> </p>","<strong>","</strong>");
$good=array("<br />","","");

$descriptionb = str_replace($bad,$good,$descriptiona);
$descriptionc=preg_replace("/<span[^>]*>/", "<span>",$descriptionb);
$descriptiond=preg_replace("/<p[^>]*>/","<p>",$descriptionc);
$description=preg_replace("/<a href=[^>]*>/","<a href='mailto:$email' class='link'>",$descriptiond) ; 

Also the last line:

$description=preg_replace("/<a href=[^>]*>/","<a href='mailto:$email' class='link'>",$descriptiond) ; 

seems to be giving me a sql error when I try to insert it into the db.

 

Oh... It may be because I have some temporary echoes in there to show each stage....

echo "a=".$descriptiona."<br />b=".$descriptionb."<br />c=".$descriptionc.  etc.

[effigy]

• You don't need to create a new variable name each time; you can overwrite it
  
• There's no need to use * because that could replace <span> with <span>
  
• Take note of the formatting/spacing below
  

 

<?php
$description = $_REQUEST['description2'] ;

$bad = array('<p> </p>', '<strong>', '</strong>');
$good = array('<br />', '', '');
$description = str_replace($bad, $good, $description);

$description = preg_replace('/<span[^>]+>/', '<span>', $description);
$description = preg_replace('/<p[^>]+>/', '<p>', $description);
$description = preg_replace('/<a href=[^>]+>/', "<a href='mailto:$email' class='link'>", $description);
?>

[defeated]

Ok, I think I get that. Thank you.

Can I put regex expressions into an array like I have with the str_replace?  That would get rid of a few lines of code... bearing in mind that I may be adding more things to be replaced... probably will infact.  I'm trying to clean up tinyMce output when I send it to my db.

[effigy]

Can I put regex expressions into an array like I have with the str_replace?

 

Per the docs:

 

pattern

The pattern to search for. It can be either a string or an array with strings.

 

Also, make sure you're escaping the data that goes into the database; see mysql_real_escape_string, e.g.

[defeated]

Thanks again. Not too woried about escaping data since it is an in-house app requiring two passwords to enter it.

.... or is there another reason for escaping data other than security?

[effigy]

Because quotes may cause a problem, e.g.: INSERT INTO table VALUES ('I'll create an error.')

Additionally, SQL injection could take place.

[defeated]

Thanks once again effigy,

I don't really follow how real_escape_string() works exactly but work it does. I think I'll post a question in the mysql section.

You have been brilliant. I'm going to mark this topic solved (while starting another one about removing a duplicate <span> where they occur together.)

Thanks again effigy.