PHP: Очищающие фильтры

Очищающие фильтры

**Список очищающих фильтров**
Идентификатор	Имя	Флаги	Описание
`FILTER_SANITIZE_EMAIL`	"email"		Удаляет все символы, кроме букв, цифр и !#$%&'+-=?^_`{\|}~@.[]*.
`FILTER_SANITIZE_ENCODED`	"encoded"	`FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_STRIP_BACKTICK`, `FILTER_FLAG_ENCODE_LOW`, `FILTER_FLAG_ENCODE_HIGH`	Кодирует строку в формат URL, при необходимости удаляет или кодирует специальные символы.
`FILTER_SANITIZE_MAGIC_QUOTES`	"magic_quotes"		Применяется функция addslashes().
`FILTER_SANITIZE_NUMBER_FLOAT`	"number_float"	`FILTER_FLAG_ALLOW_FRACTION`, `FILTER_FLAG_ALLOW_THOUSAND`, `FILTER_FLAG_ALLOW_SCIENTIFIC`	Удаляет все символы, кроме цифр, +- и, при необходимости, .,eE.
`FILTER_SANITIZE_NUMBER_INT`	"number_int"		Удаляет все символы, кроме цифр и знаков плюса и минуса.
`FILTER_SANITIZE_SPECIAL_CHARS`	"special_chars"	`FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_STRIP_BACKTICK`, `FILTER_FLAG_ENCODE_HIGH`	Экранирует HTML-символы '"<>& и символы с ASCII-кодом, меньшим 32, при необходимости удаляет или кодирует остальные специальные символы.
`FILTER_SANITIZE_FULL_SPECIAL_CHARS`	"full_special_chars"	`FILTER_FLAG_NO_ENCODE_QUOTES`,	Эквивалентно вызову htmlspecialchars() с установленным параметром `ENT_QUOTES`. Кодирование кавычек может быть отключено с помощью установки флага `FILTER_FLAG_NO_ENCODE_QUOTES`. Аналогично htmlspecialchars(), этот фильтр принимает во внимание default_charset и, если будет обнаружена некорректная последовательность байт для данной кодировки, то вся строка будет признана негодной и результатом будет строка нулевой длины. При использовании этого фильтра в качестве фильтра по умолчанию, ознакомьтесь с предупреждением ниже об установке флагов по умолчанию в 0.
`FILTER_SANITIZE_STRING`	"string"	`FILTER_FLAG_NO_ENCODE_QUOTES`, `FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_STRIP_BACKTICK`, `FILTER_FLAG_ENCODE_LOW`, `FILTER_FLAG_ENCODE_HIGH`, `FILTER_FLAG_ENCODE_AMP`	Удаляет теги, при необходимости удаляет или кодирует специальные символы.
`FILTER_SANITIZE_STRIPPED`	"stripped"		Псевдоним фильтра "string".
`FILTER_SANITIZE_URL`	"url"		Удаляет все символы, кроме букв, цифр и $-_.+!'(),{}\|\\^~[]`<>#%";/?:@&=*.
`FILTER_UNSAFE_RAW`	"unsafe_raw"	`FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_STRIP_BACKTICK`, `FILTER_FLAG_ENCODE_LOW`, `FILTER_FLAG_ENCODE_HIGH`, `FILTER_FLAG_ENCODE_AMP`	Бездействует, при необходимости удаляет или кодирует специальные символы. Этот фильтр является псевдонимом `FILTER_DEFAULT`.

Внимание

При использовании одного из этих фильтров в качестве фильтра по умолчанию либо через ваш ini-файл, либо через конфигурацию веб-сервера, флаги по умолчанию установлены в значение FILTER_FLAG_NO_ENCODE_QUOTES. Вам необходимо явно установить параметру filter.default_flags значение 0 для наличия пустых кавычек по умолчанию. К примеру:

Пример #1 Настройка фильтра по умолчанию для работы аналогично функции htmlspecialchars


filter.default = full_special_chars
filter.default_flags = 0

Список изменений

Версия	Описание
5.2.11/5.3.1	Слеши (/) удаляются `FILTER_SANITIZE_EMAIL`. Ранее они сохранялись.

add a note

User Contributed Notes 14 notes

down

Anonymous ¶

3 years ago


FILTER_SANITIZE_STRING doesn't behavior the same as strip_tags function.    strip_tags allows less than symbol inferred from context, FILTER_SANITIZE_STRING strips regardless.
<?php
$smaller = "not a tag < 5";
echo strip_tags($smaller);    // -> not a tag < 5
echo filter_var ( $smaller, FILTER_SANITIZE_STRING); // -> not a tag
?>

down

googlybash24 at aol dot com ¶

6 years ago


Remember to trim() the $_POST before your filters are applied:

<?php

// We trim the $_POST data before any spaces get encoded to "%20"

// Trim array values using this function "trim_value"
function trim_value(&$value)
{
    $value = trim($value);    // this removes whitespace and related characters from the beginning and end of the string
}
array_filter($_POST, 'trim_value');    // the data in $_POST is trimmed

$postfilter =    // set up the filters to be used with the trimmed post array
    array(
            'user_tasks'                        =>    array('filter' => FILTER_SANITIZE_STRING, 'flags' => !FILTER_FLAG_STRIP_LOW),    // removes tags. formatting code is encoded -- add nl2br() when displaying
            'username'                            =>    array('filter' => FILTER_SANITIZE_ENCODED, 'flags' => FILTER_FLAG_STRIP_LOW),    // we are using this in the url
            'mod_title'                            =>    array('filter' => FILTER_SANITIZE_ENCODED, 'flags' => FILTER_FLAG_STRIP_LOW),    // we are using this in the url
        );

$revised_post_array = filter_var_array($_POST, $postfilter);    // must be referenced via a variable which is now an array that takes the place of $_POST[]
echo (nl2br($revised_post_array['user_tasks']));    //-- use nl2br() upon output like so, for the ['user_tasks'] array value so that the newlines are formatted, since this is our HTML <textarea> field and we want to maintain newlines
?>

down

Willscrlt ¶

2 years ago


To include multiple flags, simply separate the flags with vertical pipe symbols.

For example, if you want to use filter_var() to sanitize $string with FILTER_SANITIZE_STRING and pass in FILTER_FLAG_STRIP_HIGH and FILTER_FLAG_STRIP_LOW, just call it like this:

$string = filter_var($string, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_LOW);

The same goes for passing a flags field in an options array in the case of using callbacks.

$var = filter_var($string, FILTER_SANITIZE_SPECIAL_CHARS,
array('flags' => FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH));

Thanks to the Brain Goo blog at popmartian.com/tipsntricks/for this info.

down

AntonioPrimera ¶

2 years ago


Please be aware that when using filter_var() with FILTER_SANITIZE_NUMBER_FLOAT and FILTER_SANITIZE_NUMBER_INT the result will be a string, even if the input value is actually a float or an int.

Use FILTER_VALIDATE_FLOAT and FILTER_VALIDATE_INT, which will convert the result to the expected type.

down

david dot drakulovski at gmail dot com ¶

4 years ago


Here is a simpler and a better presented ASCII list for the <32 or 127> filters 
(if wikipedia confused the hell out of you):

http://www.danshort.com/ASCIImap/

down

marcus at synchromedia dot co dot uk ¶

9 years ago


It's not entirely clear what the LOW and HIGH ranges are. LOW is characters below 32, HIGH is those above 127, i.e. outside the ASCII range.

<?php
$a = "\tcafé\n";
//This will remove the tab and the line break
echo filter_var($a, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);
//This will remove the é.
echo filter_var($a, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH);
?>

down

galvao at galvao dot eti dot br ¶

5 years ago


Just to clarify, since this may be unknown for a lot of people:



ASCII characters above 127 are known as "Extended" and they represent characters such as greek letters and accented letters in latin alphabets, used in languages such as pt_BR.



A good ASCII quick reference (aside from the already mentioned Wikipedia article) can be found at: http://www.asciicodes.com/

down

darren at daz-web dot com ¶

28 days ago


For those looking for a simple way around filtering POST forms that have textarea elements in them. If you also need tab for example you can extend quite easily.

<?php 
//create an array of all relevant textareas
$textareas = array("ta1");

foreach($_POST as $k => $v)
    {
        $v = trim($v);//so we are sure it is whitespace free at both ends
    
        //preserve newline for textarea answers
        if(in_array($k,$textareas))$v=str_replace("\n","[NEWLINE]",$v); 
    
        //sanitise string
        $v = filter_var($v, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_BACKTICK);
    
        //now replace the placeholder with the original newline
        $_POST[$k] = str_replace("[NEWLINE]","\n",$v);
    }

//simple form for testing submital

?><!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Filter test</title>
</head>

<body>
    
<form action="" method="post">
    <p>
        <textarea name="ta1" cols="30" rows="10"><?php echo $_POST['ta1']; ?></textarea>
    </p>
    <p>
        <input type="text" name="txt1" size="30" value="<?php echo $_POST['txt1']; ?>" />
    </p>
    <p>
        <input type="submit" />    
    </p>
    </form>

</body>
    
</html>

down

-3

adellemfrank at hotmail dot com ¶

6 years ago


A good list of which ASCII characters are < 32 and > 127 can be found at: http://en.wikipedia.org/wiki/ASCII#ASCII_printable_characters

down

-10

Anonymous ¶

5 years ago


Support for FILTER_SANITIZE_FULL_SPECIAL_CHARS was added from version 5.3.3

down

-10

scamber256 at hotmail dot de ¶

7 years ago


Just a hint I tested,

You can obtain all the chars <32 (so newline and c.return), by using not operator > !FILTER_FLAG_STRIP_LOW as the last argument.

Example:
filter_input(INPUT_GET,'test',FILTER_SANITIZE_STRING,!FILTER_FLAG_STRIP_LOW);

The filter keeps working as before removing anything else as before apart from FILTER_FLAG_STRIP_LOW.
Just filter those "bad" chars <32 manually you don't want.

down

-15

googlybash24 at aol dot com ¶

6 years ago


This should help with most simple "textarea" fields in post forms.

Removing user html tags while maintaining text formatting such as newlines and carriage returns involves using the FILTER_SANITIZE_STRING filter ID with the flag !FILTER_FLAG_STRIP_LOW. The formatting text (the low ASCII values under decimal 32) are encoded because of the included FILTER_FLAG_ENCODE_LOW flag, but you are now preventing these from being removed. When you want to display the value on the page back in its intended format, use nl2br() so the encoded newlines are formatted properly on the page.

This example cleans $_POST data from a textarea field with the name "user_tasks" on a previous html form, stripping tags but maintaining formatting (at least for newlines):

<?php
$postfilter =
    array(
            'user_tasks'    =>    array('filter' => FILTER_SANITIZE_STRING, 'flags' => !FILTER_FLAG_STRIP_LOW),    // removes tags. formatting code is encoded -- add nl2br() when displaying
        );

$revised_post_array = filter_input_array(INPUT_POST, $postfilter);    // must be referenced via a variable which is now an array that takes the place of $_POST[]
echo (nl2br($revised_post_array['user_tasks']));    // here we use nl2br() for the displayed value, for the ['user_tasks'] array value so that the newlines are formatted
?>

down

-23

Dmitry Snytkine ¶

7 years ago


Beware that FILTER_FLAG_STRIP_LOW strips NEWLINE and TAG and CARRIAGE RETURN chars. If you have a form that accepts user input in plaintext format, all the submitted text will lose all the line breaks, making it appear all on one line. This basically renders this filter useless for parsing user-submitted text, even in plain text.

down

-12

Ruth ¶

2 years ago


This is an example for a form having a group of checkboxes besides a lot of other inputs:

$args = array(
    'details' => array(
        'name' => 'details[]',
        'filter' => FILTER_SANITIZE_STRING,
        'flags'  => FILTER_REQUIRE_ARRAY
    )
    // , 
    // a lot of other stuff here (all the form’s elements)
);
$myInputs = filter_input_array( INPUT_GET, $args, true );

where the checkboxes are (their form is in a page that reloads itself):

<label>
    <input type="checkbox" name="details[]" value=“A” <?php if (in_array( “A”, $myInputs['details'] )) { echo 'checked'; } ?>>
    Show A
</label>
<label>
    <input type="checkbox" name="details[]" value=“B” <?php if (in_array( “B”, $myInputs['details'] )) { echo 'checked'; } ?>>
    Show B
</label>
<label>
    <input type="checkbox" name="details[]" value=“C” <?php if (in_array( “C”, $myInputs['details'] )) { echo 'checked'; } ?>>
    Show C
</label>
<label>
    <input type="checkbox" name="details[]" value=“D” <?php if (in_array( “D”, $myInputs['details'] )) { echo 'checked'; } ?>>
    Show D
</label>

add a note