PHP: Filtros de saneamiento

Filtros de saneamiento

**Lista de filtros de saneamiento**
ID	Nombre	Banderas	Descripción
`FILTER_SANITIZE_EMAIL`	"email"		Elimina todos los caracteres menos letras, dígitos y !#$%&'*+-=?^_`{\|}~@.[].
`FILTER_SANITIZE_ENCODED`	"encoded"	`FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_ENCODE_LOW`, `FILTER_FLAG_ENCODE_HIGH`	String URL-encode, opcionalmente elimina o codifica caracteres especiales.
`FILTER_SANITIZE_MAGIC_QUOTES`	"magic_quotes"		Aplica addslashes().
`FILTER_SANITIZE_NUMBER_FLOAT`	"number_float"	`FILTER_FLAG_ALLOW_FRACTION`, `FILTER_FLAG_ALLOW_THOUSAND`, `FILTER_FLAG_ALLOW_SCIENTIFIC`	Elimina todos los caracteres a excepción de los dígitos, `+-` y, opcionalmente, `.,eE`.
`FILTER_SANITIZE_NUMBER_INT`	"number_int"		Elimina todos los caracteres excepto dígitos y los signos de suma y resta.
`FILTER_SANITIZE_SPECIAL_CHARS`	"special_chars"	`FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_ENCODE_HIGH`	Escapa caracteres HTML `'"<>&` y caracteres con valores ASCII menores que 32, opcionalmente elimina o codifica caracteres especiales.
`FILTER_SANITIZE_FULL_SPECIAL_CHARS`	"full_special_chars"	`FILTER_FLAG_NO_ENCODE_QUOTES`,	Equivalente a llamar a htmlspecialchars() con `ENT_QUOTES` establecido. Las comillas de codificación pueden ser desactivadas mediante el establecimiento de `FILTER_FLAG_NO_ENCODE_QUOTES`. Al igual que htmlspecialchars(), este filtro tiene en cuenta el default_charset y si en una secuencia de bytes se detecta que contiene un carácter no válido en el conjunto de caracteres actual entonces el string completo es rechazado lo que resulta en un string de longitud 0. Cuando se utiliza este filtro como un filtro predeterminado, vea la advertiencia de abajo sobre establecer las banderas predeterminadas a 0.
`FILTER_SANITIZE_STRING`	"string"	`FILTER_FLAG_NO_ENCODE_QUOTES`, `FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_ENCODE_LOW`, `FILTER_FLAG_ENCODE_HIGH`, `FILTER_FLAG_ENCODE_AMP`	Elimina etiquetas, opcionalmente elimina o codifica caracteres especiales.
`FILTER_SANITIZE_STRIPPED`	"stripped"		Alias del filtro "string".
`FILTER_SANITIZE_URL`	"url"		Elimina todos los caracteres excepto letras, dígitos y $-_.+!*'(),{}\|\\^~[]`<>#%";/?:@&=.
`FILTER_UNSAFE_RAW`	"unsafe_raw"	`FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_ENCODE_LOW`, `FILTER_FLAG_ENCODE_HIGH`, `FILTER_FLAG_ENCODE_AMP`	No hace nada, opcionalmente eliminar o codificar caracteres. Este filtro es un alias de `FILTER_DEFAULT`.

Advertencia

Cuando se utiliza uno de estos tres filtros como un filtro predetermindo a través de fichero ini o de la configuración del servidor web, las banderas predeterminadas son establecidas a FILTER_FLAG_NO_ENCODE_QUOTES. Se necesita establecer explícitamente filter.default_flags a 0 para tener la codificación de comillas por omisión. Como esto:

Ejemplo #1 Configurar el filtro predeterminado para que actúe como htmlspecialchars

filter.default = full_special_chars
filter.default_flags = 0

Historial de cambios

Versión	Descripción
5.2.11/5.3.1	Las barras (`/`) son eliminadas por `FILTER_SANITIZE_EMAIL`. Antes se mantenían.

Improve This Page

Learn How To Improve This Page • Submit a Pull Request • Report a Bug

＋add a note

User Contributed Notes 10 notes

down

googlybash24 at aol dot com ¶

12 years ago

Remember to trim() the $_POST before your filters are applied:

<?php

// We trim the $_POST data before any spaces get encoded to "%20"

// Trim array values using this function "trim_value"
function trim_value(&$value)
{
    $value = trim($value);    // this removes whitespace and related characters from the beginning and end of the string
}
array_filter($_POST, 'trim_value');    // the data in $_POST is trimmed

$postfilter =    // set up the filters to be used with the trimmed post array
    array(
            'user_tasks'                        =>    array('filter' => FILTER_SANITIZE_STRING, 'flags' => !FILTER_FLAG_STRIP_LOW),    // removes tags. formatting code is encoded -- add nl2br() when displaying
            'username'                            =>    array('filter' => FILTER_SANITIZE_ENCODED, 'flags' => FILTER_FLAG_STRIP_LOW),    // we are using this in the url
            'mod_title'                            =>    array('filter' => FILTER_SANITIZE_ENCODED, 'flags' => FILTER_FLAG_STRIP_LOW),    // we are using this in the url
        );

$revised_post_array = filter_var_array($_POST, $postfilter);    // must be referenced via a variable which is now an array that takes the place of $_POST[]
echo (nl2br($revised_post_array['user_tasks']));    //-- use nl2br() upon output like so, for the ['user_tasks'] array value so that the newlines are formatted, since this is our HTML <textarea> field and we want to maintain newlines
?>

down

terry dot marsault at gmail dot com ¶

6 months ago

None of these parameters do answer my need, so I've made my own function, hope it helps some other folks!

function removeSpecialChars($valueToClean)
{
    return htmlspecialchars(str_replace([",", "#", "$", "%", "*", "~", "'", "=", "{", "[", "|", "`", "^", "]", "}", ":", ";", "<", ">", "/", "?", "&"], "", $valueToClean));
}

down

Anonymous ¶

9 years ago

FILTER_SANITIZE_STRING doesn't behavior the same as strip_tags function.    strip_tags allows less than symbol inferred from context, FILTER_SANITIZE_STRING strips regardless.
<?php
$smaller = "not a tag < 5";
echo strip_tags($smaller);    // -> not a tag < 5
echo filter_var ( $smaller, FILTER_SANITIZE_STRING); // -> not a tag
?>

down

finkenb2 at msu dot edu ¶

11 months ago

With the deprecation of FILTER_SANITIZE_STRING, the "use htmlspecialchars instead" is an incomplete comment.  The functionality of FILTER_SANITIZE_STRING was a combination of htmlspcialchars and (approximately) strip_tags.  For true compatibility a polyfil may be needed:

<?php
function filter_string_polyfill(string $string): string
{
    $str = preg_replace('/\x00|<[^>]*>?/', '', $string);
    return str_replace(["'", '"'], ['&#39;', '&#34;'], $str);
}

$string = "Some \"' <bizzare> string & to Sanitize < !$@%";
echo filter_var($string,FILTER_SANITIZE_STRING).PHP_EOL;
//Some &#34;&#39;  string & to Sanitize 

echo htmlspecialchars($string).PHP_EOL;
//Some &quot;&#039; &lt;bizzare&gt; string &amp; to Sanitize &lt; !$@%

echo strip_tags($string).PHP_EOL;
//Some "'  string & to Sanitize < !$@%

echo htmlspecialchars(strip_tags($string,ENT_QUOTES)).PHP_EOL;
//Some &quot;&#039;  string &amp; to Sanitize &lt; !$@%

echo filter_string_polyfill($string).PHP_EOL;
//Some &#34;&#39;  string & to Sanitize

down

ipse at sergiosantos dot me ¶

3 years ago

Although it's specifically mentioned in the above documentation, because many seem to find this unintuitive it's worth pointing out that FILTER_SANITIZE_NUMBER_FLOAT will remove the decimal character unless you specify FILTER_FLAG_ALLOW_FRACTION:

<?php
$number_string = '12.34';

echo filter_var( $number_string, FILTER_SANITIZE_NUMBER_FLOAT ); // 1234

echo filter_var( $number_string, FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION ); // 12.34
?>

down

Willscrlt ¶

8 years ago

To include multiple flags, simply separate the flags with vertical pipe symbols.

For example, if you want to use filter_var() to sanitize $string with FILTER_SANITIZE_STRING and pass in FILTER_FLAG_STRIP_HIGH and FILTER_FLAG_STRIP_LOW, just call it like this:

$string = filter_var($string, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_LOW);

The same goes for passing a flags field in an options array in the case of using callbacks.

$var = filter_var($string, FILTER_SANITIZE_SPECIAL_CHARS,
array('flags' => FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH));

Thanks to the Brain Goo blog at popmartian.com/tipsntricks/for this info.

down

marcus at synchromedia dot co dot uk ¶

14 years ago

It's not entirely clear what the LOW and HIGH ranges are. LOW is characters below 32, HIGH is those above 127, i.e. outside the ASCII range.

<?php
$a = "\tcafé\n";
//This will remove the tab and the line break
echo filter_var($a, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);
//This will remove the é.
echo filter_var($a, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH);
?>

down

AntonioPrimera ¶

8 years ago

Please be aware that when using filter_var() with FILTER_SANITIZE_NUMBER_FLOAT and FILTER_SANITIZE_NUMBER_INT the result will be a string, even if the input value is actually a float or an int.

Use FILTER_VALIDATE_FLOAT and FILTER_VALIDATE_INT, which will convert the result to the expected type.

down

galvao at galvao dot eti dot br ¶

11 years ago

Just to clarify, since this may be unknown for a lot of people:



ASCII characters above 127 are known as "Extended" and they represent characters such as greek letters and accented letters in latin alphabets, used in languages such as pt_BR.



A good ASCII quick reference (aside from the already mentioned Wikipedia article) can be found at: http://www.asciicodes.com/

down

david dot drakulovski at gmail dot com ¶

10 years ago

Here is a simpler and a better presented ASCII list for the <32 or 127> filters 
(if wikipedia confused the hell out of you):

http://www.danshort.com/ASCIImap/

＋add a note