Get and replace quoted strings with regex

Question

I'm trying to get strings inside a quote. I'm using regex but i have problems with escaped quotes.

For example, i have this:

$var = "SELECT * FROM TABLE WHERE USERNAME='Carasuman'";
preg_match_all('~([\'"])(.*?)\1~s', $var, $result);
$new = preg_replace('~([\'"])(.*?)\1~s',"<#################>",$var);

The code Works perfect. I got a replaced value in $new and quoted value in $result[1]

$new = "SELECT * FROM TABLE WHERE USERNAME=<#################>";
$result[1] = "Carasuman";

My problem is when i add a scaped quote inside quotes:

$var = "SELECT * FROM TABLE WHERE USERNAME='Carasuman\'s'";

I got this:

$new = "SELECT * FROM TABLE WHERE USERNAME=<#################>'s";
$result[1] = "Carasuman\" //must be "Carasuman\'s";

How I can avoid this error and get $new and $result[1] like first example?:

$new = "SELECT * FROM TABLE WHERE USERNAME=<#################>";
$result[1] = "Carasuman\'s";

Thanks!

Check out the positive/negative lookbehind and ignore "\'" - regular-expressions.info/lookaround.html — Lachezar
– Lachezar, Commented Sep 28, 2012 at 20:53

WebChemist · Accepted Answer · 2012-09-29 02:33:15Z

for the match, you're never going to get Carasuman's without the \ as a single matched element since you can have match skip over chars within a single match. its either going to grab the Carasuman or Carasuman\'s

just use str_replace to get rid of the backslash

preg_match_all('~([\'"])(.*)\1~s', $var, $result);
$result[2] = str_replace('\\','',$result[2]);

for the replace, the ? in the (.*?) group makes it ungreedy, meaning it will stop at the first match. Remove the ? in (.*?) to make it greedy, meaning it will keep going until the last match

preg_replace('~([\'"])(.*)\1~s',"<#################>",$var);

Edit

Rather than doing the str_replace after the match on $result[2], it would probably be better to just do beforehand on the initial string like:

$var = str_replace("\\'","'",$var); 
preg_match_all('~([\'"])(.*)\1~s', $var, $result);
$new = preg_replace('~([\'"])(.*)\1~s',"<#################>",$var);

You still need to make your wildcard match greedy like (.*?) to (.*) in order to have the apostrophe in the name included in the match/replace instead of being counted as the terminating single quote

Stegrex · Accepted Answer · 2012-09-28 20:44:58Z

0

Why don't you do this:

$var = "SELECT * FROM TABLE WHERE USERNAME='" . mysql_real_escape_string($input) . "'";

I don't think you necessarily need to do regex. Also, mysql_real_escape_string properly escapes your inputs so you can just have $input = 'Carasuman\'s'; or $input = "Carasuman's";

answered Sep 28, 2012 at 20:44

Stegrex

4,0441 gold badge19 silver badges19 bronze badges

1 Comment

Carasuman Over a year ago

I used the example of a SQL statement to make it more visible. Not necessarily be an SQL statement.

Philipp · Accepted Answer · 2012-09-28 20:49:05Z

0

To match quoted strings, you could use the regex '\'.*?(?:\\\\.[^\\\\\']*)*\'' and four double quoted strings '".*?(?:\\\\.[^\\\\"]*)*"'

answered Sep 28, 2012 at 20:49

Philipp

15.7k4 gold badges38 silver badges54 bronze badges

Collectives™ on Stack Overflow

Get and replace quoted strings with regex

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related