(PECL taint >=0.1.0)
untaint — Remove the taint mark from strings
Clears the taint mark on the given strings.
The mark is stored on the string itself, not on the variable, so this clears it for every variable sharing the same string at once. Use it to whitelist values you have validated yourself, for example after a strict allow-list check.
stringA variable holding the string to clean.
stringsFurther variables to clean.
Always returns true. When
taint.enable is off, the
function does nothing and still returns true.
Example #1 untaint() example
<?php
$id = "42";
taint($id);
if (preg_match('/^\d+$/', $id)) {
// strictly validated as digits: safe to trust
untaint($id);
}
var_dump(is_tainted($id));
?>The above example will output something similar to:
bool(false)
Note:
Only string values can carry the mark; passing a non-string is a no-op.