Strip non alphanumeric characters from a string with php

July 27, 2006 • Php by Emanuele Feronato • 43 Comments

Very simple and useful code, but hard to find in the internet.
You may need it when you code an user authentication script and want to prevent the user to hack it with ascii injection.
I will use regular expressions because it is the quickest way, and we want to be quick (almost) everytime…

1
2
3
4

<?php
$string_to_be_stripped = "Hi, I am a string and I need to be stripped...";
$new_string = ereg_replace("[^A-Za-z0-9]", "", $string_to_be_stripped );
?>

$new_string content will be: Hi I am a string and I need to be stripped without any coma or stop.

Enjoy.

Rate this post: 1 Star2 Stars3 Stars4 Stars5 Stars (47 votes, average: 4.09 out of 5)
Loading ... Loading ...
Be my fan on Facebook and follow me on Twitter! Exclusive content for my Facebook fans and Twitter followers

This post has 43 comments

  1. Karl Groves

    on November 23, 2006 at 3:17 pm

    Actually, as written, the new string will be HiIamastringandIneedtobestripped. The second parameter in ereg_replace (in your example) is not a space, but “nothing”, so the alpha characters will be joined together in one long word.

  2. trampolines

    on January 22, 2007 at 6:54 am

    also it’s really easy to do similar strips:

    only keep letters:
    $new_string = ereg_replace(“[^A-Za-z]“, “”, $string_to_be_stripped);

    keep alphanumerics and dashes
    $new_string = ereg_replace(“[^A-Za-z0-9-]“, “”, $string_to_be_stripped);

  3. Genealogy Dude

    on January 23, 2007 at 6:31 pm

    This page saved my behind this morning .. thanks to EVERYONE who contributed !

  4. Learn Hacking

    on March 24, 2007 at 4:11 am

    how about stripping only \n , \t characters only…?

  5. Craigslist Autoposter

    on May 15, 2007 at 11:34 pm

    This isn’t working for me for some reason. maybe preg_replace?

  6. chad

    on August 20, 2007 at 6:17 pm

    works great. thank you.

  7. roberto

    on November 10, 2007 at 3:49 am

    Thanks, I just improved that a bit, replacing spaces with a dash just before stripping non alphanum (or dashes).

    This is useful to let users add valid “subdomains” strings.

    I use this inside a class with my other “tools” :)

    public static function stripText($text)
    {
    $text = strtolower(trim($text));
    // replace all white space sections with a dash
    $text = str_replace(‘ ‘, ‘-’, $text);
    // strip all non alphanum or -
    $clean = ereg_replace(“[^A-Za-z0-9\-]“, “”, $text);

    return $clean;
    }

  8. Mark

    on November 20, 2007 at 4:11 am

    You’ve got to be kidding. This is the top google search for “php strip characters” and the post doesn’t even contain correct info?!?

  9. Dave Cobbe

    on January 27, 2008 at 4:55 pm

    Dude– that’s cool! Also on the hunt for a “html safe” function. Thinking of having custom blogs and incorporating limited HTML tags in the body (to include images, change fonts, etc) but would like to replace tags with hex encoded characters … anyway, sure I’ll find that somewhere — meanwhile; thanks for the regular expression. Sweet!

  10. Dave Cobbe

    on January 27, 2008 at 4:59 pm

    PS. re: Mark above — that’s a problem with Google, not this post! Last time I searched “Lithuanian Universities” I got up “Singapore”. Google! One day the revolution will come …

  11. Dragos

    on March 26, 2008 at 6:44 pm

    I use this to strip any character except alphanumeric chars and spaces.
    $data=preg_replace(“/[^A-Za-z0-9\s\s+]/”,”,$data);
    _____________________________
    http://websitetools.110mb.com

  12. Binky

    on April 7, 2008 at 11:46 pm

    Keep in mind that if you copy and paste code from this page into your code, it WILL NOT work because of slight formatting changes imposed by this page. For example, the simple double quote character is replaced by the fancy left & right slanted versions, which PHP doesn’t recognize as quotes. So paste and then check the details, then test and pay attention to any error messages.

  13. alejandro

    on May 9, 2008 at 8:59 pm

    Now, how do I count characters with diacritics such as áéíóú as valid letters (… and they’re expressed in UTF)

  14. oral

    on June 23, 2008 at 7:22 pm

    I tried

    preg_replace(”/[^A-Za-z0-9\s\s+]/”,”,$data);

    and I got

    Parse error: syntax error, unexpected ‘[‘

  15. Erik

    on June 24, 2008 at 6:35 pm

    for Karl Groves:
    to fix emanuele’s mistake you just need to add a space in the braclets, like this:

  16. Jon

    on August 19, 2008 at 4:33 pm

    So that’s what a space looks like!

  17. Mike

    on September 28, 2008 at 1:21 pm

    This saved my life.

    My script that handles the creation of license files that are used to unlock a plugin I sell wasn’t stripping non ASCII’s, and whaddya know – non ASCII’s made the unlock-function within my plugin barf.

    Thanks!

  18. Paul

    on February 13, 2009 at 5:16 pm

    Oral don’t copy past the code the quotation is wrong retype it and it workls fine.

  19. dsnip

    on April 11, 2009 at 4:57 pm

    Thanks. Useful info. It may also be useful to mention the str_replace function in PHP (http://au.php.net/str_replace). Also useful for replacing/stripping characters, but more useful in different contexts.

  20. dom

    on April 13, 2009 at 11:28 pm

    Thanks for this script!

  21. Jason

    on April 20, 2009 at 8:59 pm

    most people would use trim($string,$charlist) to do this.

  22. Ian

    on May 28, 2009 at 11:58 am

    $new_string = ereg_replace(“[^A-Za-z0-9] “, “”, $string_to_be_stripped );

    This will include spaces as well

  23. James

    on June 12, 2009 at 7:47 am

    Thank you. You are right about this code being hard to find on the Internet.

  24. insta

    on July 23, 2009 at 7:38 am

    $result = preg_replace(“/[^A-Za-z0-9\s\s+\.\:\-\/%+\(\)\*\&\$\#\!\@\"\';\n\t\r]/”,”",$text);

    Leaves almost every “normal” character. It’s my effort to nuke really weird characters that render as boxes in IE and question marks on a diamond background in Firefox.

  25. sioux

    on August 28, 2009 at 4:31 pm

    well then try this

    \\sioux & sioux[pass] *-/:, ? sioux
    they all leave ‘extra’ chars except \\

  26. anon

    on October 31, 2009 at 7:34 pm

    Insta, YOU’RE A FREEKING LIFE SAVER

  27. Zim

    on January 30, 2010 at 7:09 am

    Yay! Thank you :)

  28. pligg.com

    on March 24, 2010 at 11:16 pm

    Strip non alphanumeric characters from a string with php : Emanuele Feronato – italian geek and PROgrammer…

    leave only alphanumeric characters – no punctuation, special chars….

  29. Mark

    on April 1, 2010 at 4:05 pm

    @ Jason
    Not really, using trim you have to specify *all* the chars you don’t want preg_replace / ereg_replace and a regex allow you to specify the chars you want i.e only letters etc.

  30. Kyle

    on June 23, 2010 at 6:12 am

    Make sure to add a slash ‘/’ before the first bracket and after the second.

  31. Shmuel

    on August 11, 2010 at 11:00 am

    Here’s another solution:

    $title = preg_replace(“|[^[:alnum:][:punct:]\s]|”,”",$title);

  32. Giftvincy

    on August 18, 2010 at 8:37 pm

    nice and simple solution. thank you

  33. Yodel

    on September 6, 2010 at 10:35 pm

    I’m a php and regex noob. I’m submitting a text area and want to:
    only allow alphanumeric
    only allow common punctuation (‘”,.-)
    keep the hard returns

    Can someone help me out??

    Thanks!

  34. Abhijeet

    on September 14, 2010 at 6:45 am

    $search = preg_replace(“/[^A-Za-z0-9\s\s+]/”,” “,$search);
    is always suitable.

    php.net warning
    ereg_replace : This function has been DEPRECATED as of PHP 5.3.0. Relying on this feature is highly discouraged.
    http://php.net/manual/en/function.ereg-replace.php

  35. ComboFusion

    on September 30, 2010 at 10:00 pm

    I am trying to solve my problem with this line:

    $new_string = preg_replace(“/[^A-Za-z0-9\s\s+\.\:\-\/%+\(\)\*\&\$\#\!\@\"\';\n\t\r]/”,””,$old_string);

    Which works almost fine except for one thing. I am trying to leave characters like š???žŠ???Ž inside my $old_string, however they always get stripped.

    I was thinking that the code below could work for my case, but it doesn’t. Can anyone help me here please?

    $new_string = preg_replace(‘/[^0-9a-z?-????\`\~\!\@\#\$\%\^\*\(\)\; \,\.\'\/\_\-\š\?\?\?\ž\Š\?\?\?\Ž]/i’, ”, $old_string);

    I need to have this transformation:

    Me \ and Peter Biš?ak => Me and Peter Biš?ak

    Thank you so much in advance.

  36. Qwerp

    on October 13, 2010 at 6:27 am

    Thanks! I’ve been looking for this forever!

  37. Tihomir Ipotpaliev

    on November 25, 2010 at 11:52 am

    How about uft-8 coded chars, like .. ?,?,? ..

  38. Smith

    on April 27, 2011 at 9:14 am

    Hello guys, is it possibile to replace white spaces with white spaces?

    Example:
    $name = John Smith

    need to replace with preg_replace:

    $username = $name;
    $username = (preg_replace(“/[^A-Za-z0-9-]/”, “”, $username));

    the result in my database is:
    JohnSmith and i need
    John Smith — with white spaces inside

    Thanks :)

  39. seki

    on May 25, 2011 at 6:33 am

    @Smith

    the solution is already described above
    $username = (preg_replace(“/[^A-Za-z0-9\s\s+\-]/”, “”, $username));

    I added \- because I assume you wish to allow for “double or triple barrel names like John Smith-Brown.
    An interesting situation arises when you have O’Brien etc .. I remove the ‘ since it causes way more trouble than its worth. But if you want to include it simply add \’ to the masking string.

  40. rp pl

    on June 9, 2011 at 1:54 pm

    this is very good. Good work, it solves my problem. Thanks.

  41. kht

    on July 21, 2011 at 12:36 pm

    Hi,

    this function allowed for space to leave alone, but how to limit only into single space?
    so double or more space will removed?

    thanks

  42. Roark

    on July 28, 2011 at 5:22 pm

    Hi
    Correct me if I’m wrong… Isn’t ‘str_replace’ faster than any regular expression based function?

  43. theadsbook

    on October 8, 2011 at 10:15 pm

    this is really very useful

< >