i am using php in order to validate a form where users register. please help me to solve the following validations.

1. name can have spaces. ex= john smith
presently the validation i am using is     if( $fname == ""  || !eregi("^[a-zA-Z_]+$", $fname) )
i need the syntax which would accept a-zA-Z WITH A SPACE IN BETWEEN NAMES ex= john smith

2. text can have spaces and special characters ex= ref 100/abcd
presently the validation i am using is     if( $depositnumber == ""  || !eregi("^[a-zA-Z0-9_]+$", $depositnumber) )
i need the syntax which would accept a-zA-Z0-9 WITH A SPACE IN BETWEEN AND SPECIAL CHARACTERS ex= ref 100/abcd

3. spaces in numbers. ex= 123 4567
presently the validation i am using is     if( $phonenumber == ""  || !eregi("^[0-9]+$", $phonenumber) )
i need the syntax which would accept 0-9 WITH A SPACE IN BETWEEN ex= 123 4567

4. in case of [a-zA-Z0-9_] if i remove the "_" after 9 will it have a negative impact or is this a syntax due to which i

should i leave the "_" as part of [a-zA-Z0-9_]

5. using stripslashes() function
due to the above validation there is no way a user can enter special characters which could lead to sql injection. inspite of

this should i still use stripslashes to be on the safe side.

please provide the exact syntax for the above validations to works as specified for different scenarios.

thanks.

This question seems to be a regular expression syntax problem, not necessarily a PHP problem. I would suggest Googling some regular expression tutorials to find some readily available regex classes.

To give you a little of a step to begin with:

1) The  php function eregi is case insensitive, so there really isn't a need to validate for both uppercase and lowercase letters with regex.

2) secondly, http://www.regular-expressions.info/ is a great resource for regular expression tutorials, with many available samples.

3) In response to your question #4, [a-zA-Z0-9_] is specifying a regex class that basically says any alphanumeric number, or an underscore of any number of characters.

4) In response to question #5, i would always escape characters, and do everything possible to prevent sql injection, except i wouldn't use stripslashes, as it can be worked around: example

echo stripslashes("\test"); #outputs: test
echo stripslashes("\\test"); #outputs: test
echo stripslashes("\\\test"); #outputs: \test
echo stripslashes("\\\\test"); #outputs: \test

Better off using mysql_real_escape_string as this function was built to prevent sql injection. See the PHP manual for a best practice example of executing a query to prevent sql injection: http://ca.php.net/manual/en/fu...string.php (example #3).

Hope that gets you started.


_________________
somewhere a clock is ticking...

For spaces use \s


_________________
http://www.linkedin.com/in/khokchin