How to match the character '&' and replace it in php

Question

My main problem is that some output is coming on the page with a space character written as " ". I want to replace it back with a space. I tried str_replace("&nbsp"," ",$mystr) and even preg_replace("/( )/", " ", $mystr) but to no avail. How do I do this? And more generally, if there are other html codes coming as output, like "&", is there a way to replace them with the actual character output instead of the html code?

Edit: Let me clarify a few things here: I don't want people to enter " < s c r i p t > " tags in the source of an editable page. To prevent that, we need some mechanism to escape special characters. But the problem is that some valid characters are also escaped. I want to unescape them, but also want to make sure that no security is breached.

Answer 1

I think you're looking for html_entity_decode.

Answer 2

Take a look at html_entity_decode function.

Answer 3

str_replace should replace that part of the text as it doesn't take regular expressions in account, so there is some other problem i guess

Answer 4

I believe the function you're looking for is http://us2.php.net/manual/en/function.urldecode.php urldecode

Answer 5

<?php
   $string = "<p>Hello,& n b s p ;world</p>"; # Remove the spaces here - Stackoverflow bug doesn't let me enter the normal string.
   $string = str_replace("& n b s p ;", " ", $string);
   print $string;
?>

This works for me. Perhaps you were expecting it to modify the string in place instead of returning the modified version?

Answer 6

Are you just doing this?

str_replace("&nbsp", " ", $mystr);

Or do you do this?

$mystr = str_replace("&nbsp", " ", $mystr);

Both str_replace and preg_replace return a value, they don't change the string in-place.

Answer 7

Have you tried:

$text=html_entity_decode(str_replace('& nbsp;',' ',$text));

[remove the space between the ampersand and nbsp: it's due to Stack Overflow's formatting]

It'll swap the no-breaking-spaces with normal spaces and then decode any other remaining html entities.

Answer 8

What you actually need is an HTML filter based on a proper HTML parser so you can let only specified bits and pieces of HTML be passed through by your script.

Answer 9

Look at HTML Purifier. Give it a whitelist of allowed tags/attributes, and it will filter everything for you.

Answer 10

Since the trailing semicolon may be obmitted, you might want consider using a regular expression:

preg_replace("/&nbsp[;]?/", " ", $str)

You can replace [;]? by ;?. But Stack Overflow seems to replace &nbsp‍; (this is written with a ZERO WIDTH JOINER U+200D) so I used [;]?.