• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1772
  • Last Modified:

Function to strip tags using array and preg_replace

I have a credit application form that goes from Step 1 > Processor 1 > Step 2 > Processor 2 > References Page > References Processor > Step 3 > Processor 3 > Step 4.

I'm holding information in the session until the final Processor 3 page. Step 4 is just a submission confirmation page. I am wanting to strip all tags from all form fields and have this code on Processor 3. Here's what I have but I seem to be over looking something that is missing or wrong. I'm thinking I need to define what $document is? If so, how is this done? Thanks in advance.
<?php
session_start();
$SID=session_id();
 
//connection statement
require_once('../Connections/devnet.php');
 
 
//STRIP TAGS
 
function strip_selected_tags($document)
{
$search = array('@<script[^>]*?>.*?</script>@si',  // Strip out javascript
               '@<[\/\!]*?[^<>]*?>@si',            // Strip out HTML tags
               '@<style[^>]*?>.*?</style>@siU',    // Strip style tags properly
               '@<![\s\S]*?--[ \t\n\r]*>@'         // Strip multi-line comments including CDATA
);
$text = preg_replace($search, '', $document);
return $text;
}
 
//setup variables
$checking = $_POST['checking'];
$checking_bank_name = $_POST['checking_bank_name'];
$checking_bank_location = $_POST['checking_bank_location'];
$checking_account_number = $_POST['checking_account_number'];
$savings = $_POST['savings'];
$savings_bank_name = $_POST['savings_bank_name'];
$savings_bank_location = $_POST['savings_bank_location'];
$savings_account_number = $_POST['savings_account_number'];
$cc_type = $_POST['cc_type'];
$cc_number = $_POST['cc_number'];
$cc_expire = $_POST['cc_expire'];
$cc_holdername = $_POST['cc_holdername'];
$cc_signature = $_POST['cc_signature'];
$agree = $_POST['agree'];
$agree_date = $_POST['agree_date'];
 
 
$ssn=$_SESSION['ssn'];
$dl=$_SESSION['dl'];
$owner_ssl=$_SESSION['owner_ssl'];
$d_and_b=$_SESSION['d_and_b'];
$fid=$_SESSION['fid'];
 
//generate unique key 
//BEGIN UNIQUE ACCESS DENIED IDENTIFIER
// END DMS_UNIQUE_ID 
 
//END UNIQUE ACCESS DENIED IDENTIFIER
 
$Key=DMS_unique_id();
 
 
//insert data into database tables
$sql="INSERT INTO ...credit_app1 (first_name,middle_initial,last_name,firm_name,address1,address2,city,state,zip,bill_address1,bill_address2,bill_city,bill_state,bill_zip,home_phone,busi_phone,fax,antec) VALUES ('".$_SESSION['first_name']."','".$_SESSION['middle_initial']."','".$_SESSION['last_name']."','".$_SESSION['firm_name']."','".$_SESSION['address1']."','".$_SESSION['address2']."','".$_SESSION['city']."','".$_SESSION['state']."','".$_SESSION['zip']."','".$_SESSION['bill_address1']."','".$_SESSION['bill_address2']."','".$_SESSION['bill_city']."','".$_SESSION['bill_state']."','".$_SESSION['bill_zip']."','".$_SESSION['home_phone']."','".$_SESSION['busi_phone']."','".$_SESSION['fax']."','$Key')";
$result=mysql_query($sql)or die(mysql_error() . " - $sql");
$last_id = mysql_insert_id();
 
$sql2="INSERT INTO ...credit_app2 (appID,ssn,dl,dob,sole_prop_owner_name,owner_ssl,d_and_b,fid,business_type,business_type2,owned_since,housing_status,landlord,landlord_phone,prev_address1,prev_address2,prev_city,prev_state,prev_zip,relative_name,relative_phone,relative_address1,relative_address2,relative_city,relative_state,relative_zip) VALUES ('$last_id',AES_ENCRYPT('$ssn','$Key'),AES_ENCRYPT('$dl','$Key'),'".$_SESSION['dob']."','".$_SESSION['sole_prop_owner_name']."',AES_ENCRYPT('$owner_ssl','$Key'),AES_ENCRYPT('$d_and_b','$Key'),AES_ENCRYPT('$fid','$Key'),'".$_SESSION['business_type']."','".$_SESSION['business_type2']."','".$_SESSION['owned_since']."','".$_SESSION['housing_status']."','".$_SESSION['landlord']."','".$_SESSION['landlord_phone']."','".$_SESSION['prev_address1']."','".$_SESSION['prev_address2']."','".$_SESSION['prev_city']."','".$_SESSION['prev_state']."','".$_SESSION['prev_zip']."','".$_SESSION['relative_name']."','".$_SESSION['relative_phone']."','".$_SESSION['relative_address1']."','".$_SESSION['relative_address2']."','".$_SESSION['relative_city']."','".$_SESSION['relative_state']."','".$_SESSION['relative_zip']."')";
$result=mysql_query($sql2)or die(mysql_error() . " - $sql2");
 
$sql4="INSERT INTO ...credit_app_ref (appID,trade1_name,trade1_account,trade1_address1,trade1_address2,trade1_city,trade1_state,trade1_zip,trade1_terms,trade1_opened,trade1_phone,trade2_name,trade2_account,trade2_address1,trade2_address2,trade2_city,trade2_state,trade2_zip,trade2_terms,trade2_opened,trade2_phone,trade3_name,trade3_account,trade3_address1,trade3_address2,trade3_city,trade3_state,trade3_zip,trade3_terms,trade3_opened,trade3_phone) VALUES ('$last_id','".$_SESSION['trade1_name']."','".$_SESSION['trade1_account']."','".$_SESSION['trade1_address1']."','".$_SESSION['trade1_address2']."','".$_SESSION['trade1_city']."','".$_SESSION['trade1_state']."','".$_SESSION['trade1_zip']."','".$_SESSION['trade1_terms']."','".$_SESSION['trade1_opened']."','".$_SESSION['trade1_phone']."','".$_SESSION['trade2_name']."','".$_SESSION['trade2_account']."','".$_SESSION['trade2_address1']."','".$_SESSION['trade2_address2']."','".$_SESSION['trade2_city']."','".$_SESSION['trade2_state']."','".$_SESSION['trade2_zip']."','".$_SESSION['trade2_terms']."','".$_SESSION['trade2_opened']."','".$_SESSION['trade2_phone']."','".$_SESSION['trade3_name']."','".$_SESSION['trade3_account']."','".$_SESSION['trade3_address1']."','".$_SESSION['trade3_address2']."','".$_SESSION['trade3_city']."','".$_SESSION['trade3_state']."','".$_SESSION['trade3_zip']."','".$_SESSION['trade3_terms']."','".$_SESSION['trade3_opened']."','".$_SESSION['trade3_phone']."')";
$result=mysql_query($sql4)or die(mysql_error() . " - $sql4");
 
$sql3="INSERT INTO ...credit_app3 (appID,checking,checking_bank_name,checking_bank_location,checking_account_number,savings,savings_bank_name,savings_bank_location,savings_account_number,cc_type,cc_number,cc_expire,cc_holdername,cc_signature,agree,agree_date) VALUES ('$last_id','$checking','$checking_bank_name','$checking_bank_location',AES_ENCRYPT('$checking_account_number','$Key'),'$savings','$savings_bank_name','$savings_bank_location',AES_ENCRYPT('$savings_account_number','$Key'),'$cc_type',AES_ENCRYPT('$cc_number','$Key'),'$cc_expire','$cc_holdername',AES_ENCRYPT('$cc_signature','$Key'),'$agree','$agree_date')";
$result=mysql_query($sql3)or die(mysql_error() . " - $sql3");
 
 $insertGoTo = "...credit_application_4";
      if (isset($_SERVER['QUERY_STRING'])) {
      $insertGoTo .= (strpos($insertGoTo, '?'))? "" : "";
      //$insertGoTo .= $_SERVER['QUERY_STRING'];
    }
      print "<script language=\"javascript\">";
      print "window.location='$insertGoTo'";
      print "</script>";
 
?>

Open in new window

0
Guest85
Asked:
Guest85
  • 3
  • 2
1 Solution
 
Guest85Author Commented:
Thanks. I've already been to that site many times and it didn't help. Although, I figured it out myself stripping the above tags.

How would I strip out all punctuation? Here's what I have so far but it is stripping out all text:
//STRIP TAGS
function strip_selected_tags($document){
$search = array('@<script[^>]*?>.*?</script>@si',  // Strip out javascript
               '@<[\/\!]*?[^<>]*?>@si',            // Strip out HTML tags
               '@<style[^>]*?>.*?</style>@siU',    // Strip style tags properly
               '@<![\s\S]*?--[ \t\n\r]*>@',         // Strip multi-line comments including CDATA
			   	'@\[\]\(\)',							// URL brackets
				'@:;\'_\*%@&?!',						// URL space before
				'@\.,:;\'\-_\*@&\/\\\\\?!#',			// URL space after
				'@\.,:;\'\-_\*%@&\/\\\\\?!#',		// URL all
				'@\'"\*<>'							// Special Quotes
);
$text = preg_replace($search, '', $document);
return $text;
}

Open in new window

0
 
b0lsc0ttIT ManagerCommented:
What punctuation exactly?  There isn't a regex shorthand for punctuation so you will need to specify the specific characters in a class (e.g. [.,-]).

Do you have a line above that is trying to do this and not working?  From your comment it seems like that is the case but I don't see any line that is even trying to remove punctuation.

bol
0
Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

 
b0lsc0ttIT ManagerCommented:
Please explain why your post at http:#21885891 should be an answer.  What is the status of this?  Why did you try to close this by accepting one of your comments that just asks a question?

Also it isn't appropriate to try to close a question with one of your comments if you haven't responded to all expert posts.

bol
0
 
Guest85Author Commented:
Sorry if I did this incorrectly. I'm new to this. And still figuring out how all this works regarding accepting solutions, giving points, monitoring questions, etc. I figured the script out over the weekend.
0
 
Guest85Author Commented:
I previously asked if $document needed to be assigned or not. Well...It doesn't. No one gave me any specific answers to what I needed to fix or what was missing. So I played around with the script and the variables for a while and figured it out. I previously did not specify where the funciton was used. I had:

$checking = ($_POST['checking']);

I figured out that I needed to place the strip_selected_tags before the $_POST

Also, I needed to strip punctuation from being submitted to the database. So I figured that out other than the [ ] (square brackets) but I don't think those are a big deal. I tried 1 and 2 backslashes before each but that didn't work. So I just stopped trying as I don't think they'll be a problem.
//STRIP TAGS
function strip_selected_tags($document){
$search = array('@<script[^>]*?>.*?</script>@si',  // Strip out javascript
               '@<[\/\!]*?[^<>]*?>@si',            // Strip out HTML tags
               '@<style[^>]*?>.*?</style>@siU',    // Strip style tags properly
               '@<![\s\S]*?--[ \t\n\r]*>@',         // Strip multi-line comments including CDATA
			   '[[~`!@#$%^&*(){}|\<>?/.,"\\\';:_\+=-\[\]]]',	// Special characters and punctuation
);
$text = preg_replace($search, '', $document);
return $text;
}
 
//setup variables
$checking = strip_selected_tags($_POST['checking']);

Open in new window

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now