[Solved] Regex Help

[DeltaRocked]

Hi,

Type String 1 :

<META CONTENT="1; url=http://roundtopstatebank.com" HTTP-EQUIV=refresh>

Type String 2 :

<META HTTP-EQUIV=refresh CONTENT="1; url=http://roundtopstatebank.com">

Present Regex:

(?i)(?:<[\s*]{0,1}meta http-equiv[\s*]{0,1}=[\s*]{0,1}["']{0,1}refresh["']{0,1}[^>]*)content[\s*]?=[\s*]?\"(.*?)\"

This regex extract "Content" from string 2 but fails while processing String 1. Is there any way , by what of which I can have 1 regex which will extract "Content" from both the strings?

regards

Edited November 2, 2012 by DeltaRocked

[Chance]

pffff

#include <Array.au3>
Global $Test[2]
$Test[0] = '<META CONTENT="1; url=http://roundtopstatebank.com" HTTP-EQUIV=refresh>'
$Test[1] = '<META HTTP-EQUIV=refresh CONTENT="1; url=http://roundtopstatebank.com">'

For $I = 0 To 1
$Result = StringRegExp($test[$I], "(?i)<META.*?CONTENT=""(.*?)"".*?>", 3)
_ArrayDisplay($Result)
Next

In case its the url ur after

#include <Array.au3>
Global $Test[2]
$Test[0] = '<META CONTENT="1; url=http://roundtopstatebank.com" HTTP-EQUIV=refresh>'
$Test[1] = '<META HTTP-EQUIV=refresh CONTENT="1;url=http://roundtopstatebank.com">'

For $I = 0 To 1
$Result = StringRegExp($test[$I], "(?i)<META.*?CONTENT=[""'](?:d{0,3};s?url=)(.*?)[""'].*?>", 3)
_ArrayDisplay($Result)
Next

Edited November 2, 2012 by FlutterShy

[blityon]

$arrayDatos = StringRegExp($datos, '<META .*? CONTENT="(.*?)".*?>', 3)

Edited November 2, 2012 by blityon

[Robjong]

Try to avoid using a lazy dot ".*?", instead use a negating character class "[^"]*" whenever possible. This avoids unnecessary backtracking and thus increases performance.

#include <Array.au3>


Global $sString = '<META CONTENT="1; url=http://roundtopstatebank.com" HTTP-EQUIV=refresh>' & @LF & _
        '<META HTTP-EQUIV=refresh CONTENT="1;url=http://roundtopstatebank.com">' & @LF


$aResult = StringRegExp($sString, '(?i)<meta[^>]+contents*=s*"([^"]+)"[^>]*>', 3) ; content
$aResult = StringRegExp($sString, '(?i)<meta[^>]+contents*=s*"d+;s*url=([^"]+)"[^>]*>', 3) ; URL only

_ArrayDisplay($aResult)

[Chance]

Try to avoid using a lazy dot ".*?", instead use a negating character class "[^"]*" whenever possible. This avoids unnecessary backtracking and thus increases performance.

#include <Array.au3>


Global $sString = '<META CONTENT="1; url=http://roundtopstatebank.com" HTTP-EQUIV=refresh>' & @LF & _
'<META HTTP-EQUIV=refresh CONTENT="1;url=http://roundtopstatebank.com">' & @LF


$aResult = StringRegExp($sString, '(?i)<meta[^>]+contents*=s*"([^"]+)"[^>]*>', 3) ; content
$aResult = StringRegExp($sString, '(?i)<meta[^>]+contents*=s*"d+;s*url=([^"]+)"[^>]*>', 3) ; URL only

_ArrayDisplay($aResult)

Note taken, just opened my eyes to some flaws in a project of mine, thanks for the contribution!

[guinness]

Isn't using ? next to * pointless? So .*? is the same as .* but not .+?.

[Robjong]

No.

.* will match 0 or more occurrences of any character (except for newline, assuming single line mode),

.+ would match 1 or more occurrences of any character,

they would consume the largest possible match, this is called greedy.

But in .*? the lazy operator (?) will tell it to return the smallest possible match, which would match nothing or 1 character.

Because the pattern ".*?" starts and ends with a quote the engine will look for 0 or more character between 2 quotes, this would match against "", as well as "1".

If we had the pattern ".+?" and matched it against the subject "" it would fail, because it needs at least 1 character, so it would match "1".

Example:

$sSubject = 'A string with a "quoted part", and a separate " floating in there.'

; Greedy
$aResult = StringRegExp($sSubject, '".*"', 3) ; matches : "quoted part", and a separate "
_ArrayDisplay($aResult, "Greedy")

; Lazy
$aResult = StringRegExp($sSubject, '".*?"', 3) ; matches: "quoted part"
_ArrayDisplay($aResult, "Lazy")

[guinness]

I was having a dumb moment then. Thanks Robjong.

[DeltaRocked]

wow. learn't a lot from these posts. thank you everyone.

now need to test this regex in real world pages - which incidentally contain phishing / malwares / clean too .

regards

[Chance]

So, what's it you're doing?

[DeltaRocked]

malware research.