best way to escape and create a slug

Question

Possible Duplicate:
URL Friendly Username in PHP?

im somehow confused in using proper functions to escape and create a slug

i used this :

$slug_title = mysql_real_escape_string()($mtitle);

but someone told me not to use it and use urlencode()

which one is better for slugs and security

as i can see in SO , it inserts - between words :

https://stackoverflow.com/questions/941270/validating-a-slug-in-django

View my answer here http://stackoverflow.com/questions/2955251/php-function-to-make-slug-url-string/10360316#10360316 — Imran Omar Bukhsh, Apr 28 '12 at 03:35

score 12 · Answer 1 · answered Apr 05 '10 at 19:26

12

Using either MySQL or URL escaping is not the way to go.

Here is an article that does it better:

function toSlug($string,$space="-") {
    if (function_exists('iconv')) {
        $string = @iconv('UTF-8', 'ASCII//TRANSLIT', $string);
    }
    $string = preg_replace("/[^a-zA-Z0-9 -]/", "", $string);
    $string = strtolower($string);
    $string = str_replace(" ", $space, $string);
    return $string;
}

This also works correctly for accented characters.

answered Apr 05 '10 at 19:26

Thomas

150,847
41
308
421

problem is for arabic and mb languages this function wont work and changes all characters to - – Mac Taylor Apr 05 '10 at 20:05
2

Unfortunately iconv seems to work inconcistently across platforms: php -r 'print iconv("UTF-8", "ASCII//TRANSLIT","bär") . "\n";' gives 'bar' on Ubuntu (10.04) and 'b"ar' on my Mac. – tuomassalo Nov 26 '10 at 06:27
3

Ah... PHP's platform independency... gotta love it. – Thomas Nov 27 '10 at 21:11
Yes... Even not working with string like: markedsføring – Shailesh Thanki May 25 '13 at 06:47

Dor · Answer 2 · 2010-04-05T20:15:23.943

mysql_real_escape_string() has different purpose than urlencode() which both aren't appropriate for creating a slug.

A slug is supposed to be a clear & meaningful phrase that concisely describes the page.

mysql_real_escape_string() escapes dangerous characters that can change the purpose of the original query string.

urlencode() escapes invalid URL characters with "%" followed by 2 hex digits that represents their code (e.g. %20 for space). This way, the resulting string will not be clear & meaningful, because of the unpleasant characters sequences, e.g. http://www.domain.com/bad%20slug%20here%20%3C--

Thus any characters which may be affected by urlencode() should be omitted, except for spaces that are usually replaced with -.

best way to escape and create a slug

2 Answers2

Linked