PHP正则表达式澄清

Question

I am using this preg_match value to verify that the input into the server is clean from all sorts of malicious characters.

preg_match('/^[a-zA-Z)(\!@&,0-9\?_\-\.\s\*&\$
]{0,'. $str_length.'}$/',$_POST['text'])

If there's no match I return false, and the server won't accept it. I would like to add links to that input. so that I can get:

"hello there, this is my picture: http://myserver.com/imgs/user-images/user222.jpg 
and this is my dog http://myserver.com/imgs/user-images/user222-dog.jpg"

How can I add links to my input?

Answer 1

I think you should rather use something like htmlentities and your RDBMS library tools to avoid malicious characters rather than implement your own regex. Yours seems very restrictive : no + sign, no colon, no semi-colon, no percent... I don't know what your application is, but users might dislike that.