Using functions inside preg_replace

Question

$TOPIC_CONTENT = preg_replace("!<code>(.+)</code>!is","<div style='color: #00FF00;
background-color: #000000; border-radius: 5px; margin: 5px;"<pre>".htmlspecialchars("$0")."</pre></div>",$TOPIC_INFO->content);

How can I get this to work? I have no idea how to pull this off, and I know my current way is invalid.

Don't parse HTML with regex: stackoverflow.com/questions/1732348/… (see the first answer to that question) — Cfreak
– Cfreak, Commented Mar 4, 2012 at 2:29
I'm not parsing it, I'm trying to get the text between the code tags and run htmlspecialchars() on it and create a new div around it. — Shane Larson
– Shane Larson, Commented Mar 4, 2012 at 2:34

Community · Accepted Answer · 2023-11-17 20:42:18Z

3

Use preg_replace_callback. Be a little careful with your regex .. I think you want to use .+? instead of just .+. The usual mantra is "don't parse html with regex," but for something as simple as this I don't see the harm.

edited Nov 17, 2023 at 20:42

CommunityBot

11 silver badge

answered Mar 4, 2012 at 2:33

Explosion Pills

192k56 gold badges341 silver badges417 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Shane Larson Over a year ago

Yeah your right I forgot about the whole greedyness thing. Thanks I didn't know about this function.

Qtax · Accepted Answer · 2012-03-04 02:50:46Z

2

Except for preg_replace_callback as in tandu's answer, you can also use the /e switch, and your replacement string will be *e*valuated as PHP code, and its result will be used.

I.e you could do:

preg_replace("!<code>(.+?)</code>!ise",
    '"<pre style=\"color: #0f0; background: #000;\">" . htmlspecialchars("$1") . "</pre>"',
    $string);

answered Mar 4, 2012 at 2:50

Qtax

34k9 gold badges92 silver badges127 bronze badges

5 Comments

Platinum Azure Over a year ago

Of course, you absolutely shouldn't use any sort of eval-like functionality if you don't have absolute control over both the code being evaluated and the input that might feed into said code. Is htmlspecialchars a good enough function to prevent malicious execution? I don't know (not being a PHP expert), and I suggest you don't use this answer until you can be absolutely sure.

Shane Larson Over a year ago

Good point Platinum Azure. Also thanks Qtax for the information.

Qtax Over a year ago

@PlatinumAzure, the "input" (that is $1 in this case) is irrelevant. It can't do any harm no matter what content it has. @Shane, say thanks with the vote button instead. ;-)

Platinum Azure Over a year ago

@Qtax: Shane Larson never said where the HTML was coming from. On a forum that supports a <code> tag, the input is highly relevant.

Qtax Over a year ago

@Platinum, relevant how exactly? Of course the expression will replace whatever part matches with the result of the evaluated string. So what's is your point? You see some problem here except matching "HTML" with regex? In that case tell us what it is.

Collectives™ on Stack Overflow

Using functions inside preg_replace

2 Answers 2

1 Comment

5 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

5 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related