validation problem

[slanton]

I am using this to validate

...elseif ($firstName==""or !ereg("^[A-Za-z' -]{1,30}$",$firstName)){
$message = "Please enter a valid Name";
}

and if I enter a name and then a tag it catches the error eg "Frank</" is not allowed. But if I enter

"Frank&</" it doesn't catch the error although the data is entered into the database as "Frank" which is weird. Why does it do that?

[xyn]

elseif( (!$firstname) || (!preg_match('^|i[A-Za-z]{1,30}$, $firstname)) )

[slanton]

Thanks but that doesn't work. I would also like to understand why the ereg functions like that.

[AdRock]

This should work

 

if(!ereg("^[A-Za-z]{2,30}$",$firstname))

[slanton]

Well yes that does work but that is pretty much what I have already except I want to also allow a space, a hyphen and an apostrophe so I use

!ereg("^[A-Za-z' -]{1,30}$",$firstName))

My reading of that is that it would allow uppercase and lowercase letters spaces, hyphens and  apostrophes. But it also allows the use of & ...and once the & is used it allows the use of < and / etc.If I don't use the & it doesn't allow < or/.

So my question really is why dose the above expression allow the use of & and how can I exclude it?