Advanced username validation? help?

Not really advanced, just not all in one ereg/ whichever function.....

[GamingLoft]

Ok, im making a function to check usernames at registration, but im having a lot of difficulty making this work!

heres what i have right now... but its not quite cutting it!

function checkUsername($username) 
{
if (eregi('^[[:alnum:]\.\?\!\-\_\'\-]{4,12}$', stripslashes(trim($username)) )) {//must be 4-12 letters/chars long .?! - _ ' all aloud + nums and letters
    $errors = array(); 
$user = mysql_real_escape_string($username);
    $query_usernamecheck = "SELECT username FROM hfs_users WHERE username = '$username'";
    $result = @mysql_query($query_usernamecheck);
    $num_samename = @mysql_num_rows($result_usernamecheck);
    
    if ($num_samename> 0) { //checks if anyone is using this name
      $errors[] = "This name is not availible.";//error message if someones using name
}
    else {
$user = mysql_real_escape_string($username);
    $query_blockedname = "SELECT username FROM hfs_blockedname WHERE username = '$username'";
    $result_blockedname = @mysql_query($query_blockedname);
    $num_blockedname = @mysql_num_rows($result_usernamecheck);
    
    if ($num_blockedname> 0) {
$errors[] = "The username you entered is not aloud.";//error message if name is put in unacceptable list
}}}
     else {
      $errors[] = "You're username must be 4-12 letters long and contain only letters, numbers and the following characters: .?! - _";
    }
if(!empty($errors)){ return $errors; } 
return false; 
} 

and here is the file im currently using to test this...

<?php
include("mysql_connect.php");
include("functions.php");
$urlname = $_GET['name']; 
if(($rslt = checkUsername($urlname)) === false) 
{
echo 'Its all good.'; 
} 
else 
{   
echo implode('<br />', $rslt); 
}
?>

so yeah, the reason that function isn't "cutting it" is because i want my error messages to be more detailed. like right now the length of the message and characters share the same error message.

i would like my users to know specifically what went wrong with there message

so make a function for the length of the username and take out the {4,12} from my eregi?

but i have no idea how i could do that.

any ideas? everytime i tried i failed... :( sadly.

[phparion]

for the size you can use simple function strln() to find the length of the username string.

one more thing I noticed in your function is that you are allowing? and . (DOT) in the username. this will create lots of problems for you if you will use SE friendly URLs with mod rewrite e.g

example.com/membersprofiles/member-name.-is-here./

or even query string

example.com/profile.php?membername=phpar?ion

so give it a second thought before allowing these symbols

[GamingLoft]

hmm i don't think i intentianally allowed . (DOT)

also ive tried strlen, i know how to use strlen just everytime i try to put it in the function i get random errors on my page.

ill post a code snippet again.

ok i changed my function to just check if it was less than 4, (for now, then after ill add one to check if its more than 12 but, now i get this when running my tester file (see 1st post)

"You're username must contain only letters, numbers and the following characters: .?! - _"

this gets echoed no matter what! any help please?

ill explain what i did i took the {4,12} out from the ereg statement. thats all, and also added this in...

""

if (strlen($username) < 4){
$errors[] = "Username must be atleast 4 characters in length!";
}

""

so what do i do? here is my full function...

"

function checkUsername($username) 
{
if (eregi('^[[:alnum:]\?\!\-\_\'\-]$', stripslashes(trim($username)) )) {//must be 4-12 letters/chars long .?! - _ ' all aloud + nums and letters
    $errors = array(); 
$user = mysql_real_escape_string($username);
    $query_usernamecheck = "SELECT username FROM hfs_users WHERE username = '$username'";
    $result = @mysql_query($query_usernamecheck);
    $num_samename = @mysql_num_rows($result_usernamecheck);
    
    if ($num_samename> 0) { //checks if anyone is using this name
      $errors[] = "This name is not availible.";//error message if someones using name
}
    else {
if (strlen($username) < 4){
$errors[] = "Username must be atleast 4 characters in length!";
}
else
{
$user = mysql_real_escape_string($username);
    $query_blockedname = "SELECT username FROM hfs_blockedname WHERE username = '$username'";
    $result_blockedname = @mysql_query($query_blockedname);
    $num_blockedname = @mysql_num_rows($result_usernamecheck);
    
    if ($num_blockedname> 0) {
$errors[] = "The username you entered is not aloud.";//error message if name is put in unacceptable list
}}}}
     else {
      $errors[] = "You're username must contain only letters, numbers and the following characters: .?! - _";
    }
if(!empty($errors)){ return $errors; } 
return false; 
} 

[edited by: GamingLoft at 10:03 pm (utc) on Feb. 6, 2008]

[GamingLoft]

I have fixed this problem by removing a " $ " from my ereg statement, i had no idea why it was there so i figured why not take it out...

here is the top bit of my new function...

if (eregi('^[[:alnum:]\?\!\-\_\'\-]', stripslashes(trim($username)) )) {//must be 4-12 letters/chars long .?! - _ ' all aloud + nums and letters

i just removed the $ from that line, see post above for rest of code + old line.....

kthx. Derek.

[coopster]

In regular expressions, the caret symbol (^) may often represent the beginning anchor and the dollar sign an ending anchor. Details are on the

» regex man pages

link on the Regular Expression Functions (POSIX Extended) [php.net] PHP manual page.