[PHP] preg_replace help...

[DDRtists]

This is the one function I have alllllways had problems with. And now, I have come to the need for it, so I need to get it working.

I need to, pretty much, make a very very basic BBC system. Such as taking [img=somechick.jpg] from a string and turning it into <img src="thepic.jpg" />

I haven't been able to grasp the concept yet, and most of the sites go into farrr too much detail for my learning style, way too fast.

So if someone would post up how to get this, it would help greatly. Thanks

 

[tooltiperror]

I was planning on writing a tutorial for regexp's in PHP, which would greatly help you for pattern matching. Here's a basic example, replaces all lowercase t's with capital t's. Wait a day or two for the entire tutorial, it will help a lot.

<?php

	$str = 'tooltiperror';
	$str = preg_replace('/t/','T',$str);
	echo $str;

?>

 

[DDRtists]

Well I got my mod_rewrite script up, so it can't be too different. I finally figured out the basics.
After pulling my hair for a good 3 or 4 hours...

 

[GetTriggerUnit-]

This converts [IMG(Image Title)(Image source)] into <img title="Image Titlte" src="Image source"/>
e.g. [IMG(Hot Chick)(hot_chick.png)] -> <img title="Hot Chick" src="hot_chick.png"/>

    $startIndex = 0;
    $endIndex = 0;
    $tsi = 0;
    $tei = 0;
    $psi = 0;
    $pei = 0;
    while (true) {
        $startIndex = strpos($tmp, '[IMG', $endIndex);
        if (!$startIndex)
            break;
        $endIndex = strpos($tmp, ']', $startIndex);
        $s = substr($tmp, $startIndex, $endIndex - $startIndex);
        $tsi = strpos($s, '(', 0);
        $tei = strpos($s, ')', $tsi);
        $psi = strpos($s, '(', $tei);
        $pei = strpos($s, ')', $psi);
        $tmp = substr($tmp, 0, $startIndex) . '<img title="' . substr($s, $tsi + 1, $tei - $tsi - 1) . '" src="' . substr($s, $psi + 1, $pei - $psi - 1) . '"/>' . substr($tmp, $endIndex + 1, strlen($tmp) - $endIndex);
    }

 

[phyrex1an]

[IMG("><script type="text/javascript" src="http://you.are/pwnd.js"></script>)(lol)]

Always escape your output. Even in code meant for teaching purpose.

 

[Magentix]

This will help for tags without attributes:

function b($matches) {
	return '<b>'. filter_var($matches[1],FILTER_SANITIZE_SPECIAL_CHARS) .'</b>';
}
$input = 'Retrieve your [b]input[/b] here';
$evil = 'Retrieve your [b]</b><script>alert(0);</script><b>[/b] here';
$output = preg_replace_callback('%\[b\](.*?)\[/b\]%i','b',$input);
$output_evil = preg_replace_callback('%\[b\](.*?)\[/b\]%i','b',$evil);

// Merely for testing purposes
echo $output . "<br />\n";
echo $output_evil . "<br />\n";

Build on this example for advanced functionality.
You can't do this without any knowledge of PCRE, though.


Edit: here's how it looks with attributes (like your IMG example)

function img($matches) {
	return '<img src="'. filter_var($matches[1],FILTER_SANITIZE_SPECIAL_CHARS) . '" />';
}
$input = '[img=http://servername/img.jpg]';
$evil = '[img=http://servername/img.jpg?"><script>alert(0)</script><div id="]';
$output = preg_replace_callback('%\[img=(.*?)\]%i','img',$input);
$output_evil = preg_replace_callback('%\[img=(.*?)\]%i','img',$evil);

// Merely for testing purposes
echo $output;
echo $output_evil;

Note the filters:
- Content that is intended to be used in html needs to be escaped
- HOWEVER: Trying to escape directly on a backreference (e.g.: $1) doesn't work
- SOLUTION: A callback function using the matches array