in reply to Untainting name data from form
If you're trying to untaint names, you might have better luck adopting a strategy of exclusion. Strip out characters that should never appear in names (e.g., ';<>&'). If you try work up patterns that accept valid names, you're going to face a sequence of suprises. Your pattern, for example, won't match "O'Reilly". That's an easy fix, but then you'll run into last names like "Steele-Stubbings" or "St. Dennis", requiring more punctuation within names.
Better, I think, to exclude obvious garbage.
|
|---|