Scot, my eyes water when I look at a long regexp.
So without trying to work out that specific PCRE syntax, I'll suggest
two things:
1) Make a generic detection that finds zero or more junk characters
between the text you're looking for. The longer the "parent" string is,
the less likely you are to have a false positive, e.g.
finding filler between "ab"
BAD:
a.*b
This is bad because it is too greedy and matches the longest line that
has "a" then zero or any amount of characters up to the buffer size, and
then a "b".
LESS BAD:
a.{0,2}b
This is less bad because we're restricting the count of the wildcard to
0 through 2 characters between the "a" and the "b", but it's still bad
because the string is so short. Even if this were gibberish, you will
likely hit it eventually as a false positive when finding it in the MIME
encoding of a binary file.
AWESOME:
Taking a long string like a phone number and dropping the:
.{0,2}
between each of the bits of text you think the bad guy will try to stuff
with junk, including whitespace. Replace the "2" with however many
characters you think are sensible. I think Declude wants the brace
characters escaped, e.g.:
.\{0,2\}
is the syntax to use in a PCRE.
2) A while back I had to fix some ugly regexp that plain old didn't
work, and I used a Windows shareware app called The Regex Coach and it
worked for me.
http://weitz.de/regex-coach/
Andrew.
________________________________
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Scott Fisher
Sent: Tuesday, July 03, 2007 12:34 PM
To: [email protected]
Subject: [Declude.JunkMail] phone regex/pcre help
I'm looking to replace these lines with a pcre but it doesn't
seem to be working. Any suggestions?
BODY 175 CONTAINS 206 888-2083
BODY 175 CONTAINS 206.8882083
BODY 175 CONTAINS 2068882083
BODY 175 CONTAINS 206-8882083
BODY 175 CONTAINS 206 8882083
BODY 175 PCRE
(?i:[\(\{]?2[0o]6[\)\}]?{\-\_\.\s}?888{\-\_\.\s}?2[0o]83)
Scott Fisher
Dir of IT
Farm Progress Companies
191 S Gary Ave
Carol Stream, IL 60188
Tel: 630-462-2323
This email message, including any attachments, is for the sole
use of the intended recipient(s) and may contain confidential and
privileged information. Any unauthorized review, use, disclosure or
distribution is prohibited. If you are not the intended recipient,
please contact the sender by reply email and destroy all copies of the
original message. Although Farm Progress Companies has taken reasonable
precautions to ensure no viruses are present in this email, the company
cannot accept responsibility for any loss or damage arising from the use
of this email or attachments.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
