Really Quick PHP Help REQ

[dirtysouth]

I need to trim special characters out of a form because it's parsing the "'" (single quote) and fucking up a cart I'm building. Users that have something like "Joe's Mags" crashes the cart due to the single quote. Here's what I have:

if(!empty($_POST['shipcompany']))
{
    $shipcompany= trim($_POST['shipcompany']);
}
else
{
    $shipcompany = '';
} 

Been mucking around with this:

$shipcompany = "'!£$%^&ss*()}{@:'#~/?><>/ 1 2 3 4 5 3/.,/:@/||\-=-__++-¬``1`sds";
$shipcompany = preg_replace('/[^a-z0-9]/', '', $shipcompany); 

I just don't know how to mesh the code together. Thanks in advance as you guys always come through in a pinch and the client is pinching the fuck outta me ATM!

[Zorgman]

Why not addslashes?

[brandonstills]

http://us.php.net/addslashes

[fluffygrrl]

And btw, don't start the regexp engine if you don't REALLY need it. it's a hog.

[k0nr4d]

I'm in awe that you know how to write regex like that but didn't know about addslashes :P

[bDok]

or ... mysql_real_escape_string

ugh.

[fluffygrrl]

I'm in awe that you know how to write regex like that but didn't know about addslashes :P

I think it's pretty obvious he c/p'd stuff he found on the internetz.

[GrouchyAdmin]

or ... mysql_real_escape_string

ugh.

Don't forget, mysql_real_escape_string() requires a handler, so you must have an open DB socket to use it.

For the love of god, people, learn to sanitize your variables.