RegEx Whitelist Problem

Question

I'm a little confused. I am running all my inputs through a basic sanitize function I write to only allow certain characters, but characters such as [] are still being allowed.

function sanitize($input) {
$pattern = "/[^a-zA-z0-9_-]/";
$filtered = preg_replace($pattern, "", $input);
return $filtered;}

Any idea why it's doing that?

Answer 1

You have a typo in your pattern string that's causing the problem

/[^a-zA-z0-9_-]

You want A-Z instead.

---

btw: you might be interested in the character class [:alnum:] and/or the PCRE_CASELESS modifier