Preg_replace help - Replace ' " \ and / ?

[mat3000000]

I need a way of just replacing those three characters (",',\,/) with nothing, any ideas?

[MasterACE14]

str_replace()

[mat3000000]

I have tried this but I only want to do this on a single string with, ideally, one function and the quotes just close the parameter in the function, resulting in errors?

[void]

escape them with \

[mat3000000]

I have no experience with the preg_ function, so could you show me how I would amend this:

 

$q = preg_replace("/[????]/","",$str);

 

Please could you explain what you are putting in there, or give me a link to a site which takes you through the syntax.

Thanks in advance

[AbraCadaver]

Try:

 

$string = preg_replace('#["\'\\\/]#', '', $string);

[mat3000000]

Thanks, thats what I wanted 

[mat3000000]

Just a quick question to add to this...

 

I was using this along with the mysql_escape_string() function. Is this necessary because surely mysql injection can not occur without any of those characters???

[skwap]

Just a quick question to add to this...

 

I was using this along with the mysql_escape_string() function. Is this necessary because surely mysql injection can not occur without any of those characters???

 

yes its necessary when you insert data into your sql table. If you deals with forms & you should escape the string.

:-*

[Pikachu2000]

If you're goal is to sanitize a string for use in a DB query, you don't need to remove those (or any other) characters. That's what mysql_real_escape_string() is for.

[mat3000000]

Right, so how would you suggest I do what I want to do:-

 

I have a form where user inputs data to DB.

When user logs in, they can view all their info. If I use mysql_real_escape() then all the apostrophes end up with a slash before them?

[Pikachu2000]

The your server is probably configured with magic_quotes_gpc() set to ON in your php.ini file. You would either need to set it to off, or check for magic_quotes_gpc() when escaping string data, and if it's ON, run stripslashes() on the data.

 

if( get_magic_quotes_gpc() ) {
$data = stripslashes($data);
}
$data = mysql_real_escape_string($data);