copy and paste <wbr> creates annoying minus sign. Looking for PHP filter

Question

I got a strange issue.

We're using transaction-IDs to our customers bank bookings in the following format: U123C123P123B123.

After a test booking, we copied the transaction-ID (correctly displayed) text from our online-banking output with "ctrl+c". This text, entered into our system again (by pasting strg+v) could not be processed, because:

When pasting, "<wbr>" turns into a minus sign. The minus sign is not displayed in the form field. But it will pass. MySQL can not process the request with that strange minus sign.

The source code of the bank output is as follows: "U123C123P123<wbr>B123".

Most Software (firefox, thunderbird, ...) shows the correct T-ID after pasting. Some Editors, like notepad++, Dreamweaver are showing the pasted T-ID including the minus sign. Like: "U123C123P123-B123"

How can I remove this dimwitted minus sign? I have already tried with str_replace and strip_tags.

Sorry about my english.

Answer 1

My best guess is that somehow the particular character ends up in your output before the B123.

Check the online banking system. Go to the page that shows the transaction id and save it on your hard drive. Open it with an editor that can show non printable characters (vi for instance in Linux) and check the area where the particular string appears. If the string appears with the <wbr> character then you can change the online banking system software so as it doesn't output that character there.

However (as I suspect) if you don't have access to that system in terms of modifying it and you are in need of fixing things in your end, you can attach a filter in the form field or filter the data yourself prior to the database call.

$field = strtoupper($_POST['transaction_id']);
$sanitized = str_replace('<WBR>', '', $field);
$sanitized = str_replace(chr(173), '', $sanitized);

173 is the soft hyphen &shy so that is most likely what is coming in. You can always do a var_dump on the posted data and check the actual ASCII code of what is coming in.

HTH