First, your use of \=submatch(0)
is overly-complex, just use \0. And be aware that sub-match 0 is always the fully matched pattern, so your replacement pattern has some redundancy. Second, the .
atom only matches one character. And finally, you need to escape the []
's and the $
. Try this instead:
:%s/\$_POST\['.\{-}'\]/mysql_escape_string(\0)/gc
The use of \{-}
means to match any number of the previous atom, in a non-greedy way (as opposed to *
).
I also note that your examples are inconsistent with each other. Is it "$POST_[...]
", "$_POST[...]
" or just "$POST[...]
"?
You may want to take a look at a book like Mastering Regular Expressions.