$message = str_replace

Wed, 05/06/2009 - 08:05 — russellharrower

Hi i want to block users from posting URL links
at the moment i am using this but it will only block the http://
i want if a user types in a url address i want it to say blocked instead of the URL
$message = str_replace( "http://", 'BLOCKED', $message);

Wed, 05/06/2009 - 08:40 — dmorison

Hello Russell, This is where

Hello Russell,

This is where you want to use something like preg_replace() which can match patterns as well as an exact string. Then, you can look for http:[anything] and replace that with BLOCKED, for example:

$message = preg_replace("/http(.*) /U","BLOCKED ",$message." ");

...however, it is a fair bit more complex than just that - as the rule needs to match all forms of URL, and also where they finish at the end of a line etc. Rather than try to work out a safe pattern to use, I would recommend reading through the comments on the PHP documentation page for the preg_replace function, as well as searching for "preg_replace url matching" for example - and you will find various examples...

Hope this helps!
Cheers,
David.

Mon, 05/18/2009 - 08:20 — russellharrower

Hi just wondering if you can

Hi just wondering if you can help me a bit more

I need to turn the following into
$user = [username];
$pass = [password];

This is what i need to turn into above
[USER]abc[/USER]
[PASS]123[/PASS]

so should look like
$user = 'abc';
$pass = '123';

I was hoping i could use something like
$twitter_message = preg_replace("/[USER](.*)[/USER] /U","$twitteruser = (.*);",$twitter_message." ");
$twitter_message = preg_replace("/[PASS](.*)[/PASS] /U","$twitterpass = (.*);",$twitter_message." ");

but wont work, as it will still put things in $twitter_message

Mon, 05/18/2009 - 12:35 — dmorison

Hello Russell, If I have

Hello Russell,

If I have understood your requirement correctly, you have a string $twitter_message that contains...

.....[USER]username[/USER]......[PASS]password[/PASS]....

...and you wish to extract username and password into the variables $user and $pass respectively.

Rather than preg_replace(), preg_match() is the function you want to do this. With regards to the pattern to match, "[" , "]" and "/" are all reserved characters within a regular expression, so they must be escaped with "\". It makes the pattern look a little complex, but with a single expression we can extract both username and password; for example:

  preg_match(
    "/\[USER\](.*)\[\/USER\](.*)\[PASS\](.*)\[\/PASS\]/",
    $twitter_message,
    $matches
  );
  $user = $matches[1];
  $pass = $matches[3];

Hope this helps!
Cheers,
David.

Mon, 05/18/2009 - 16:15 — russellharrower

Having a small issue

Having a small issue updating the MYSQL row
[code]
$twitter_message = preg_match(
"/\[USER\](.*)\[\/USER\](.*)\[PASS\](.*)\[\/PASS\]/",
$twitter_message,
$matches
);
$user = $matches[1];
$pass = $matches[3];
$resultb = mysql_query("UPDATE rettiwt SET username='$user' WHERE uuid='$uuid'") or die(mysql_error()) ;
echo "You may now use Twitter ATM's";
[/code]
Do you see any errors?
I am getting this error Error in query: UPDATE rettiwt SET username=`` WHERE uuid=`c82ad6d2`

Mon, 05/18/2009 - 16:22 — dmorison

Hello Russell, In principle

Hello Russell,

In principle your code and the SQL generated looks fine; often the easiest thing to do is to paste the SQL that your script constructs into the SQL of phpMyAdmin (or whatever MySQL admin tool you are using) check that the table and field names are correct.

But you will notice from the PHP error message that you are attempting to set an empty username value; so first of all it would be necessary to confirm that you have extracted a valid username from $twitter_message before proceeding, e.g. with:

if ($user && $pass)
{
   /* processing code goes here
}

More importantly however, you should always use the mysql_escape_string() function when including untrusted data within an SQL query; so your line that generates the SQL should be:

$resultb = mysql_query("UPDATE rettiwt SET username='".mysql_escape_string($user)."' WHERE uuid='$uuid'") or die(mysql_error()) ;

Hope this helps!
Cheers,
David.