preg_replace causing dollar signs get removed

Question

I have an email system, where user write a message and it will send the message. The main problem which I just found, consider this code

    $findEmail = $th         


        

Answer 1

Here is the reason:

The $1 portion of a replacement text stands for the first group/match found. So if you have abc 123 and you try preg_match('/([\w]+)-([\d]+)/'), regex will store internally something like $1 = abc and $2 = 123. Those variables are going to exists, even if they have no value.

So, for example:

$text = '[shortcode]';
$replacement = ' some $var $101 text';
$result = preg_replace('/\[shortcode\]/', $var, $text);
// returns "some $var 1 text"

As the match group $10 is empty is going to be replaced by a null string.

That's why you need to scape any $NN from your REPLACEMENT text before running the preg_replace function.

Happy coding.

Answer 2

Guess your template just includes "pure" PHP and tries to use $74 as variable, which does not exist and does not hold any data. So change the quotes in the template to single quotes '.

guessed template:

$tpl = "Sum: $74.97"; //results in "Sum: .97"

corrected template:

$tpl = 'Sum: $74.97'; //results in "Sum: $74.97"

Answer 3

If (ever) an template hast been in $getUserEmailTemplate, you did overwrite (destroy) it with this line;

$getUserEmailTemplate = "@@MESSAGE@@";

So just remove this line and make sure, $getUserEmailTemplate really contains anything and best of all a template.

Answer 4

The high-voted function escape_backreference is incomplete in the general case: it will only escape backreferences of the form $n, but not those of the form ${n} or \n.

To escape any potential backreferences, change

    $emailMessage = preg_replace('/\B@@MESSAGE@@\B/u', $findEmail, $getUserEmailTemplate);

to

    $emailMessage = preg_replace('/\B@@MESSAGE@@\B/u', addcslashes($findEmail, '\\$'), $getUserEmailTemplate);

Answer 5

Pre-parse the replacement text to escape the $ when followed by a number (remember that $n has special meaning when using in the replacement text). See the comment on the php.net docs page:

If there's a chance your replacement text contains any strings such as "$0.95", you'll need to escape those $n backreferences:

<?php
  function escape_backreference($x){
    return preg_replace('/\$(\d)/', '\\\$$1', $x);
  }
?>