PHP - Find Lines That Don't Match Regex?

This topic has been moved to PHP Regex.

http://www.phpfreaks.com/forums/index.php?topic=332077.0

While using the PHP strip_tags() function,I used  the optional second parameter to specify tags which should not be stripped.  However with these allowable_tags, I realised strip-tags is not safe.
for example with a string such as this ($str= "<p onmouseover=\"evilscript url\"> Hi, this is an interesting link. </p>") I was able to load a page containing a script injected into it, that script was able to rip off my session cookie ID!!!.

To further strengthen data sanitization using the strip_tags() function, I have come up with this function below which does the following: allows the use of the following html tags: <h1><h2><h3><h4><h5><h6><a><br><table><ul><ol><li><p><img> remove classes, ids from html tags remove font-style, font-size, color,font-family,line-height from style tags in the text; remove javascript attributes within a tag remove empty style tags

function CleanUp($InputString)
{
	
    $RemoveAttrib = "'\\s(class|id|javascript:|onclick|ondblclick|onmousedown|onmouseup|onmouseover|onmousemove|onmouseout|onkeypress|onkeydown|onkeyup)=\"(.*?)\"'i"; //remove classes, ids and disallow these attributes/prefix within a tag;
    $InputString = strip_tags($InputString, '<h1><h2><h3><h4><h5><h6><a><br><table><ul><ol><li><p><img>');
    $InputString = preg_replace($RemoveAttrib, '', $InputString);
    $RemoveAttrib = "/(font\-size|color|font\-family|line\-height):\\s".
             "(\\d+(\\x2E\\d+\\w+|\\W)|\\w+)(;|)(\\s|)/i";
	//remove font-style, font-size, color,font-family,line-height from style tags in the text;
    //$InputString = stripslashes($tagSource);
    $InputString = preg_replace($RemoveAttrib, '', $InputString);
    $InputString = str_replace(" style=\"\"", '', $InputString); //remove empty style tags, after the preg_replace above (style="");
       return $InputString;
}

This worked well for single line text, but if I had hard returns in the text the function could not find the other tags to remove, and therefore failed. See below.

<p id=
"mike" style="line-height: 150%; class="lead">The function did not strip off the paragragh ID attribute.</p>

Or

<p
 id ="mike" style="line-height: 150%; class="lead">The function did not strip off the paragragh ID attribute.</p>

I tried marching New lines as shown below but it did not work:

 $RemoveAttrib = "'\\s(class|id|javascript:|onclick|ondblclick|onmousedown|onmouseup|onmouseover|onmousemove|onmouseout|onkeypress|onkeydown|onkeyup)(\r\n)*?=\"(\r\n)*?(.*?)\"'i"; 

 I need help to fix this.   Thanks.

Hi,

I am adding "active_filter", "passive_filter" classes to links based on regex pattern coming from the URL:
Line 46: https://github.com/laanes/product_filtering/blob/master/APF_URL.php

The function gets called on line 89 in he https://github.com/laanes/product_filtering/blob/master/boxes/advanced_product_filtering_box.inc.php

You can see it in action he http://www.swanseatimber.co.uk/shop/hafele/brand_281.html by clicking on a category on the left, under the heading "Filter Your Results".

The clicked category gets a green background because of the added "active_filter" class. When you click again, it will get "passive_filter" class and the products are not filtered any more.

The problem: When moving to other pages by using the pagination at the top of the product results, the class doesn't get added.

Therefore, you can't remove the filter because function creating the href on line 72 in he https://github.com/laanes/product_filtering/blob/master/APF_URL.php

and the function clearing all filters on line 100 in he https://github.com/laanes/product_filtering/blob/master/APF_URL.php both fail.

What's interesting - when selecting a filter, moving to the next page, clicking in the browser url bar and hiting enter(hard reload i think?), the problem disappears and you can play with the filters again.

I really hope you find a minute to look into it and help me.

I have set up a function to validate user input date in yyyy-mm-dd format taking into account the following possibilities: the length of the month February 29th when the year is not a leap year When I run the code, I do not get any feedback whatsoever, when it should. This is the code below and I would appreciate your thoughts:

if(!function_exists('checkdate'))
{
	function checkdate($date, $checkyear, $currentmonth)
	{
		if($checkyear == 0)//if it is not a leap year
		{
			// if current month is february
			if($currentmonth == 2)
			{
				if(!preg_match("/^(20)\d\d[-](0[1-9]|1[012])[-](0[1-9]|1[0-9]|2[0-8])$/", $date))
				{
					// set error for date field
					return ($error = 'Invalid Date!');
				}
				return ($error = 'valid Date!');
			}
			// if current months are april, june, september or november
			elseif($currentmonth == 4 || $currentmonth == 6 || $currentmonth == 9 || $currentmonth ==11)
			{
				if(!preg_match("/^(20)\d\d[-](0[1-9]|1[012])[-](0[1-9]|1[0-9]|2[0-8]|3[0])$/", $date))
				{
					// set error for date field
					return ($error = 'Invalid Date!');
				}
				return ($error = 'valid Date!');
			}
			else
			{	
				if(!preg_match("/^(20)\d\d[-](0[1-9]|1[012])[-](0[1-9]|[12][0-8]|3[01])$/", $date))
				{
					// set error for date field
					return ($error = 'Invalid Date!');
				}
				return ($error = 'valid Date!');
			}
		}
		elseif($checkyear == 1)//if it is a leap year
		{
			// if current month is february
			if($currentmonth == 2)
			{
				if(!preg_match("/^(20)\d\d[-](0[1-9]|1[012])[-](0[1-9]|1[0-9]|2[0-9])$/", $date))
				{
					// set error for date field
					return ($error = 'Invalid Date!');
				}
				return ($error = 'valid Date!');
			}
			// if current months are april, june, september or november
			elseif($currentmonth == 4 || $currentmonth == 6 || $currentmonth == 9 || $currentmonth ==11)
			{
				if(!preg_match("/^(20)\d\d[-](0[1-9]|1[012])[-](0[1-9]|1[0-9]|2[0-9]|3[0])$/", $date))
				{
					// set error for date field
					return ($error = 'Invalid Date!');
				}
				return ($error = 'valid Date!');
			}
			else
			{	
				if(!preg_match("/^(20)\d\d[-](0[1-9]|1[012])[-](0[1-9]|[12][0-9]|3[01])$/", $date))
				{
					// set error for date field
					return ($error = 'Invalid Date!');
				}
				return ($error = 'valid Date!');
			}
		
		}
	}
$todate = getdate();
$currentmonth = $todate['mon'];
$checkyear = date('L');
$date = 2014-02-31;
echo checkdate($date, $checkyear, $currentmonth);

Edited by terungwa, 26 July 2014 - 02:43 PM.

Hi I am trying to search an array that comes from a power shell script, the array of strings that returns is ever changing as it receives variables from the script. Therefore I need to use preg_grep to search for the word "not" I am also using another array which inverts this I then need to compare these new two arrays to the original and separate the results $working and not working into a table. I would be most grateful for any advice/solutions. The preg_grep aren't displaying anything.  <?php //phpinfo(); ini_set('display_errors', 'On'); error_reporting(0);//E_ALL echo '<html> <style> body { font-family:Calibri,Helvetica,sans-serif; font-size:100%; } </style>   <head> <link rel="stylesheet" type="text/css" href="style.css">   <script type="text/javascript"> function uploadJS(){ String.prototype.trim = function() { return this.replace(/^\s+|\s+$/g, ""); }; var textAreaValue=document.getElementById(\'ServerList\').value; var trimmedTextAreaValue=textAreaValue.trim(); if(trimmedTextAreaValue!="") { document.myForm.submit(); } else{ alert("Server List Text Area is Empty"); } }; var input=document.getElementById(\'fileSelect\').value; if(input!="") { document.myForm.submit(); } else{ alert("You have not selected a file, please select one to proceed."); }       var handleFileSelect = function(e) {         var files = e.target.files;         if(files.length === 1) {         document.forms.myForm.filecsv.value = files[0].name;         }     }                 };                 </script> </head>';   #Upload Code $target = "D:\Web\Upload/";   $target = $target . basename( $_FILES['uploaded']['name']) ;   $ok=1;   if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target))   {   echo "The file ". basename( $_FILES['uploadedfile']['name']). "   has been uploaded";   }   else {     }     if ($uploaded_size > 150000)   { echo "Your file is too large.<br>";   $ok=0;   }     if ($uploaded_type =="text/php")   {   echo "No PHP files<br>";   $ok=0;   } if (!($uploaded_type=="text/csv")) { echo "<br>";  $ok=0; }    $target = "upload/";  $target = $target . basename( $_FILES['uploaded']['name']) ;  $ok=1;   //This is our size condition if ($uploaded_size > 350000) { echo "Your file is too large.<br>"; $ok=0; }  //This is our limit file type condition if ($uploaded_type =="text/php")  {  echo "No PHP files<br>"; $ok=0; }  //Here we check that $ok was not set to 0 by an error if ($ok==0) {  } //If everything is ok we try to upload it  else  {  if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target)) {  echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded"; }  else {   }  }   #Start of scripts to check Servers in textbox   if(isset($_POST['ServerList']))                 {                                 //$arry=explode( "\r\n", $_POST['ServerList'] );                 $txttrim = trim($_POST['ServerList']);                 //$textAr = explode("\n", $text);                 //$textAr1 = array_filter($text, 'trim'); // remove any extra \r characters left behind                 $txtarea = explode("\n",$txttrim);                 $txtarea = array_filter($txtarea,'trim');                                                 foreach ($txtarea as $line => $servername)                 {                                              //$line => $servername;                                 ##check if querying itself....                 }                                      echo '<pre>';     $target="D:/Web/Upload/"; $target= $target . basename( $_FILES['uploaded']['name']) ;     $csv = $target;                 //$filename= $_FILES['uploaded']['name'];                 $output=shell_exec("powershell -Command D:/Web/scripts/PHPfwrules.ps1 $csv < NUL");                 echo '<h6>';                 print_r($output);                 $nomatch=preg_grep('/^not/i',$output);                 echo $nomatch;                 $match=preg_grep("/not/",$output,PREG_GREP_INVERT);                 echo $match;                 if ($working1= array_intersect($output,$match))                                 {                 echo"<link rel=stylesheet type=text/css href=style.css>                 <table class=results>                                 <tr>                                 <th>Server Name</th>                                 <th>Working</th>                                 </tr>                                 <tr>                                 <td>".$servername."</td>                                 <td>".$working1."</td>                                 </tr></table>                                 "; } else if ($notworking1= array_intersect($output,$nomatch)) {                 echo"<link rel=stylesheet type=text/css href=style.css>                 <table class=results>                                 <tr>                                 <th>Server Name</th>                                 <th>Not Working</th>                                 </tr>                                 <tr>                                 <td>".$servername."</td>                                 <td>".$notworking1."</td>                                 </tr></table> "; } }                                                                 echo' <link rel=stylesheet href=dhtmlwindow.css type=text/css />                                                 <link rel=stylesheet type=text/css href=style.css>                                                 <script src=js/dhtmlwindow.js></script>                                                 <hr />                                                 <table class=results>                                                 <tr>                                                 <th>Server Name</th>                                                 <th>Working</th>                                                 <th>  Not Working</th>                                                 </tr>                                                 <tr>                                                 <td>'.$servername.'</td>                                                 <td>'.$working1.'</td>             <td>'.$notworking1.'</td>                                                                                                   <td></td>                                                 ';                echo '</pre>';   echo ' <h3>Firewall Implementation </h3> <h4>Please enter the server below, you can only select one server at a time. </h4> <!--The form--> <form action="fw2.php" method="post" name="myForm" id="myForm" enctype="multipart/form-data"> <textarea name=ServerList id=ServerList> </textarea> <h5>Please select a CSV file.</h5>     <input name="uploaded" type="file" /><br />                 <input type="submit" value="Submit" /> <br> </html> ' ; ?>