Limiting characters for an input form

Hi, all, I own http://tackypenguin.com.

I want to make my register form only allow users to use ([a-zA-Z0-9]+) when making a username. How would I go along to check to see if they are only using these?

 

Hi RyanDoubleyou,

Since you are posting this question under the PHP forum I assume you would like to use PHP to achieve this result.

You can simply check the post variable for the username like this:

if (preg_match("/^[a-zA-Z0-9]+$/", trim($_POST['username']))){
	// Username is correct
}
else{
	// Username is wrong
}

PHP:

Good luck with you script

Best regards
Egil Fujikawa Nes
The Marketing Techie

 

so will it take off all other characters?

 

No, this is just a simple if statment to validate the username with your username requierments.

I don't remember the exact syntax for removing all other carracters from the string, but it should be something like this:

$username = preg_replace("/[^a-zA-Z0-9\d]/i", "", trim($_POST['username']));

PHP:

Good luck with you script

Best regards
Egil Fujikawa Nes
The Marketing Techie

 

The code posted will check if the username matches the pattern. You can then process it as you wish. The following will remove prohibited characters:

$sStrippedUser = preg_replace('#[^a-z0-9]+#i', '', trim($_POST['username']));

if ( $_POST['username'] == $sStrippedUser )
{
    echo 'Your username is ' . $_POST['username'];   
}
else
{
    echo 'Prohibited characters have been removed from your username. Your username is ' . $sStrippedUser;    
}

PHP:

 

clarky_y2k3, your code didnt work for me. Thanks though. egilfujikawanes, so yours strips all the other characters?

 

That's weird, it works fine for me...

I used the input 'abc123', the result was:

With the input '$a&b^c*123', the result was:

What errors do you receive if any? What output do you receive?

 

I have

$sStrippedUser = preg_replace('#[^a-z0-9]+#i', '', trim($username));

if ( $username != $sStrippedUser )
{
$username = $sStrippedUser;
    echo 'Prohibited characters have been removed from your username. Your username is ' . $sStrippedUser;   
}

PHP:

because if the name is correct, i dont want it to say anything to the user. That makes the name blank everytime.

 

This works for me:

$sStrippedUser = preg_replace('#[^a-z0-9]+#i', '', trim($username));

if ( $username != $sStrippedUser )
{
    $username = $sStrippedUser;    
	echo 'Prohibited characters have been removed from your username. Your username is ' . $username;   
}

Code (markup):

Where is $username coming from? I'm assuming you've got register_globals enabled?

 

Okay, I got it to work somehow. Thanks man. By the way, do you know what the error:
Warning: preg_match(): Compilation failed: nothing to repeat at offset 0 in /home/content/r/y/a/ryanwalters/html/user.php on line 211
means?

Like 211 says:

if(preg_match("/$takenname/i", $Pusername))  {

PHP:

 

What's the value of $takenname?

Also, can you post lines 210-212, please?

 

$mquery = mysql_query("SELECT * FROM users") or die(mysql_error());
while($row = mysql_fetch_array($mquery)){
$takenname = $row['username'];
if(preg_match("/$takenname/i", $Pusername))  {
$regerror = "yes";
}
}

PHP:

$takenname is when it searchs in the database to see if the username requested is already registered.
$Pusername is the $_POST["username"];

 

There's a better way of accomplishing that.

Query the table to see if there are any users with the same username:

$rQuery = mysql_query('SELECT `id` FROM `users` WHERE `username` = "' . $Pusername . '"'); // replace id if appropriate

PHP:

Get the number of rows:

$iRows = mysql_num_rows($rQuery);

PHP:

It always helps to free the result:

mysql_free_result($rQuery);

PHP:

Determine if a user already exists with that username:

if ( $iRows == 1 )
{
    // username is taken
}

PHP:

 

$rQuery = mysql_query('SELECT `id` FROM `users` WHERE `username` = "' . $Pusername . '"');
$iRows = mysql_num_rows($rQuery);
$iRows = mysql_num_rows($rQuery);
if ( $iRows == 1 ) {
// username is taken
}

PHP:

And will this be seen as a copy if RyAN is in the DB, but ryan is put in the form?

 

This should eliminate any case-related issues:

$rQuery = mysql_query('SELECT `id` FROM `users` WHERE LOWER(`username`) = "' . strtolower($Pusername) . '"');

PHP:

 

Thats work. Thank you