preg_replace not catching '<3' as a replaceable text

[Monkuar]

Here are my smileys:

 

// Here you can add additional smilies if you like (please note that you must escape single quote and backslash)
$smilies = array(
	':)' => 'smile.gif',
	';)' => 'wink.gif',
	':(' => 'sad.gif',
	':mellow:' => 'mellow.gif',
	':(' => 'sad.gif',
	':angry:' => 'mad.gif',
	':cry:' => 'cry.gif',
	':banana:' => 'banana.gif',
	':locked:' => 'dancinglock.gif',
	':hug:' => 'hug.gif',
	':bonk:' => 'bangin.gif',
	':love:' => 'heart2.gif',
	'<3' => 'heart.gif',
	':blush:' => 'blush.gif',
	':p' => 'tongue.png',
	':lol:' => 'lol.png',
	':mad:' => 'mad.png',
	':rolleyes:' => 'roll.png',
	':cool:' => 'cool.png');

And here is the function to convert them to images using preg_replace

 

function do_smilies($text)
{
	global $smilies;

	$text = ' '.$text.' ';

	foreach ($smilies as $smiley_text => $smiley_img)
	{
		if (strpos($text, $smiley_text) !== false)
			$text =  preg_replace('%(?<=[>\s])'.preg_quote($smiley_text, '%').'(?=[^\p{L}\p{N}])%um', '<img src="/img/emoticons/'.$smiley_img.'" alt="'.$smiley_text.'">', $text);
	}

	return substr($text, 1, -1);
}

All of them are being replaced except for '<3', why? I tried:

 \<3 

AND

 <\3 

to see if I needed to escape the left carrot (<), but still no luck.

[requinix]

Does it work if you try

'<3' => 'heart.gif'

[wezhind]

Hi,

 

I think (though could be wrong) that this may be the reason. I found an issue somebody was having with preg_match on stackoverflow that seems similar and could explain your issue. Here's the link: http://stackoverflow.com/questions/21063742/greater-than-and-less-than-symbol-in-regular-expressions

 

The answer by boris the spider - at the top when I looked - is the one you're looking for.

 

Good luck.

[Monkuar]

  On 1/10/2015 at 9:02 AM, requinix said:

Does it work if you try

'<3' => 'heart.gif'

 

LOL!!! Yep. I was calling

htmlspecialchars

before. I should of inspected the freaking source code before making this topic, my apologizes. Thank you!

 

  On 1/10/2015 at 9:11 AM, wezhind said:

Hi,

 

I think (though could be wrong) that this may be the reason. I found an issue somebody was having with preg_match on stackoverflow that seems similar and could explain your issue. Here's the link: http://stackoverflow.com/questions/21063742/greater-than-and-less-than-symbol-in-regular-expressions

 

The answer by boris the spider - at the top when I looked - is the one you're looking for.

 

Good luck.

Oh, yeah. Nice find

 

Thanks guys!

[requinix]

  On 1/10/2015 at 3:22 PM, Monkuar said:

LOL!!! Yep. I was calling

htmlspecialchars

before. I should of inspected the freaking source code before making this topic, my apologizes. Thank you!

 

Always save functions like htmlspecialchars() until the very end, just before you're about to embed the text in HTML (be that with output or when pre-rendering HTML).

[Monkuar]

  On 1/10/2015 at 11:12 PM, requinix said:

Always save functions like htmlspecialchars() until the very end, just before you're about to embed the text in HTML (be that with output or when pre-rendering HTML).

I assume for minimal XSS protection, incase someone crafts up an exploit in one of the bbcode functions correct?

 

I should just run the htmlspecialchars at the end then. Then, I don't have to use the html entities in my smileys array to check via regex as well, and I would of never even had this problem right? Lol, I'm a debby downer sometimes, I apologize...

[requinix]

  On 1/10/2015 at 11:18 PM, Monkuar said:

I assume for minimal XSS protection, incase someone crafts up an exploit in one of the bbcode functions correct?

There's an imaginary point in the processing where before you were dealing with raw text and after you're dealing with HTML. Right then is when you apply htmlspecialchars().

do_smilies() does deal with HTML so it is after that point.

 

  On 1/10/2015 at 11:18 PM, Monkuar said:

I should just run the htmlspecialchars at the end then. Then, I don't have to use the html entities in my smileys array to check via regex as well, and I would of never even had this problem right?

Not at the end, otherwise you'd be escaping your tags.

 

do_smilies() or some other BBCode-type replacement is probably where you make the transition to dealing with HTML, so immediately before that would be when you apply htmlspecialchars().