Safe way to get alpha-numeric string from user input? (without preg_replace)
<p>I have read many other questions regarding how to filter a string to "Alpha-numeric", but all of them suggest the <code>preg_replace()</code> method.</p>

<p>According to <a href="https://www.owasp.org" rel="noreferrer">OWASP</a>:</p>

<blockquote>
  <p>Function preg_replace() should not be used with unsanitised user
  input, because the payload will be eval()’ed13. </p>
  
  <p>preg_replace("/.*/e","system(’echo /etc/passwd’)");</p>
  
  <p>Reflection also could
  have code injection flaws. Refer to the appropriate reflection
  documentations, since it is an advanced topic.</p>
</blockquote>

<p>So now how do I achieve this without preg_replace?</p>

<pre><code>$result = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['data']);
// Notice the $_POST['data']
</code></pre>