Remember to trim() the $_POST before your filters are applied:
<?php
// We trim the $_POST data before any spaces get encoded to "%20"
// Trim array values using this function "trim_value"
function trim_value(&$value)
{
$value = trim($value); // this removes whitespace and related characters from the beginning and end of the string
}
array_filter($_POST, 'trim_value'); // the data in $_POST is trimmed
$postfilter = // set up the filters to be used with the trimmed post array
array(
'user_tasks' => array('filter' => FILTER_SANITIZE_STRING, 'flags' => !FILTER_FLAG_STRIP_LOW), // removes tags. formatting code is encoded -- add nl2br() when displaying
'username' => array('filter' => FILTER_SANITIZE_ENCODED, 'flags' => FILTER_FLAG_STRIP_LOW), // we are using this in the url
'mod_title' => array('filter' => FILTER_SANITIZE_ENCODED, 'flags' => FILTER_FLAG_STRIP_LOW), // we are using this in the url
);
$revised_post_array = filter_var_array($_POST, $postfilter); // must be referenced via a variable which is now an array that takes the place of $_POST[]
echo (nl2br($revised_post_array['user_tasks'])); //-- use nl2br() upon output like so, for the ['user_tasks'] array value so that the newlines are formatted, since this is our HTML <textarea> field and we want to maintain newlines
?>
PHP - Manual: Sanitize filters
2024-11-14
Sanitize filters
| ID | Name | Flags | Description |
|---|---|---|---|
FILTER_SANITIZE_EMAIL |
"email" |
Remove all characters except letters, digits and
!#$%&'*+-=?^_`{|}~@.[].
|
|
FILTER_SANITIZE_ENCODED |
"encoded" |
FILTER_FLAG_STRIP_LOW,
FILTER_FLAG_STRIP_HIGH,
FILTER_FLAG_STRIP_BACKTICK,
FILTER_FLAG_ENCODE_LOW,
FILTER_FLAG_ENCODE_HIGH
|
URL-encode string, optionally strip or encode special characters. |
FILTER_SANITIZE_MAGIC_QUOTES |
"magic_quotes" |
Apply addslashes().
(DEPRECATED as of PHP 7.3.0 and
REMOVED as of PHP 8.0.0,
use FILTER_SANITIZE_ADD_SLASHES instead.)
|
|
FILTER_SANITIZE_ADD_SLASHES |
"add_slashes" | Apply addslashes(). (Available as of PHP 7.3.0) | |
FILTER_SANITIZE_NUMBER_FLOAT |
"number_float" |
FILTER_FLAG_ALLOW_FRACTION,
FILTER_FLAG_ALLOW_THOUSAND,
FILTER_FLAG_ALLOW_SCIENTIFIC
|
Remove all characters except digits, +- and
optionally .,eE.
|
FILTER_SANITIZE_NUMBER_INT |
"number_int" | Remove all characters except digits, plus and minus sign. | |
FILTER_SANITIZE_SPECIAL_CHARS |
"special_chars" |
FILTER_FLAG_STRIP_LOW,
FILTER_FLAG_STRIP_HIGH,
FILTER_FLAG_STRIP_BACKTICK,
FILTER_FLAG_ENCODE_HIGH
|
HTML-encode '"<>& and characters with
ASCII value less than 32, optionally strip or encode other special
characters.
|
FILTER_SANITIZE_FULL_SPECIAL_CHARS |
"full_special_chars" |
FILTER_FLAG_NO_ENCODE_QUOTES,
|
Equivalent to calling htmlspecialchars() with ENT_QUOTES set. Encoding quotes can
be disabled by setting FILTER_FLAG_NO_ENCODE_QUOTES. Like htmlspecialchars(), this
filter is aware of the default_charset and if a sequence of bytes is detected that
makes up an invalid character in the current character set then the entire string is rejected resulting in a 0-length string.
When using this filter as a default filter, see the warning below about setting the default flags to 0.
|
FILTER_SANITIZE_STRING |
"string" |
FILTER_FLAG_NO_ENCODE_QUOTES,
FILTER_FLAG_STRIP_LOW,
FILTER_FLAG_STRIP_HIGH,
FILTER_FLAG_STRIP_BACKTICK,
FILTER_FLAG_ENCODE_LOW,
FILTER_FLAG_ENCODE_HIGH,
FILTER_FLAG_ENCODE_AMP
|
Strip tags and HTML-encode double and single quotes, optionally strip
or encode special characters. Encoding quotes can be
disabled by setting FILTER_FLAG_NO_ENCODE_QUOTES.
(Deprecated as of PHP 8.1.0,
use htmlspecialchars() instead.)
|
FILTER_SANITIZE_STRIPPED |
"stripped" | Alias of "string" filter. (Deprecated as of PHP 8.1.0, use htmlspecialchars() instead.) | |
FILTER_SANITIZE_URL |
"url" |
Remove all characters except letters, digits and
$-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=.
|
|
FILTER_UNSAFE_RAW |
"unsafe_raw" |
FILTER_FLAG_STRIP_LOW,
FILTER_FLAG_STRIP_HIGH,
FILTER_FLAG_STRIP_BACKTICK,
FILTER_FLAG_ENCODE_LOW,
FILTER_FLAG_ENCODE_HIGH,
FILTER_FLAG_ENCODE_AMP
|
Do nothing, optionally strip or encode special characters. This
filter is also aliased to FILTER_DEFAULT.
|
警告
When using one of these filters as a default filter either through your ini file
or through your web server's configuration, the default flags is set to
FILTER_FLAG_NO_ENCODE_QUOTES. You need to explicitly set
filter.default_flags to 0 to have quotes encoded by default. Like this:
示例 #1 Configuring the default filter to act like htmlspecialchars
filter.default = full_special_chars
filter.default_flags = 0
更新日志
| 版本 | 说明 |
|---|---|
| 8.0.0 |
FILTER_SANITIZE_MAGIC_QUOTES has been removed.
|
| 7.3.0 |
FILTER_SANITIZE_ADD_SLASHES was added as a
replacement for FILTER_SANITIZE_MAGIC_QUOTES
|
| 7.3.0 |
FILTER_SANITIZE_MAGIC_QUOTES has been deprecated.
|
add a note
User Contributed Notes 18 notes
googlybash24 at aol dot com ¶
9 years ago
Anonymous ¶
6 years ago
FILTER_SANITIZE_STRING doesn't behavior the same as strip_tags function. strip_tags allows less than symbol inferred from context, FILTER_SANITIZE_STRING strips regardless.
<?php
$smaller = "not a tag < 5";
echo strip_tags($smaller); // -> not a tag < 5
echo filter_var ( $smaller, FILTER_SANITIZE_STRING); // -> not a tag
?>
Willscrlt ¶
6 years ago
To include multiple flags, simply separate the flags with vertical pipe symbols.
For example, if you want to use filter_var() to sanitize $string with FILTER_SANITIZE_STRING and pass in FILTER_FLAG_STRIP_HIGH and FILTER_FLAG_STRIP_LOW, just call it like this:
$string = filter_var($string, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_LOW);
The same goes for passing a flags field in an options array in the case of using callbacks.
$var = filter_var($string, FILTER_SANITIZE_SPECIAL_CHARS,
array('flags' => FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH));
Thanks to the Brain Goo blog at popmartian.com/tipsntricks/for this info.
ipse at sergiosantos dot me ¶
1 year ago
Although it's specifically mentioned in the above documentation, because many seem to find this unintuitive it's worth pointing out that FILTER_SANITIZE_NUMBER_FLOAT will remove the decimal character unless you specify FILTER_FLAG_ALLOW_FRACTION:
<?php
$number_string = '12.34';
echo filter_var( $number_string, FILTER_SANITIZE_NUMBER_FLOAT ); // 1234
echo filter_var( $number_string, FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION ); // 12.34
?>
marcus at synchromedia dot co dot uk ¶
12 years ago
It's not entirely clear what the LOW and HIGH ranges are. LOW is characters below 32, HIGH is those above 127, i.e. outside the ASCII range.
<?php
$a = "\tcafé\n";
//This will remove the tab and the line break
echo filter_var($a, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);
//This will remove the é.
echo filter_var($a, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH);
?>
AntonioPrimera ¶
5 years ago
Please be aware that when using filter_var() with FILTER_SANITIZE_NUMBER_FLOAT and FILTER_SANITIZE_NUMBER_INT the result will be a string, even if the input value is actually a float or an int.
Use FILTER_VALIDATE_FLOAT and FILTER_VALIDATE_INT, which will convert the result to the expected type.
galvao at galvao dot eti dot br ¶
9 years ago
Just to clarify, since this may be unknown for a lot of people:
ASCII characters above 127 are known as "Extended" and they represent characters such as greek letters and accented letters in latin alphabets, used in languages such as pt_BR.
A good ASCII quick reference (aside from the already mentioned Wikipedia article) can be found at: http://www.asciicodes.com/
darren at daz-web dot com ¶
3 years ago
For those looking for a simple way around filtering POST forms that have textarea elements in them. If you also need tab for example you can extend quite easily.
<?php
//create an array of all relevant textareas
$textareas = array("ta1");
foreach($_POST as $k => $v)
{
$v = trim($v);//so we are sure it is whitespace free at both ends
//preserve newline for textarea answers
if(in_array($k,$textareas))$v=str_replace("\n","[NEWLINE]",$v);
//sanitise string
$v = filter_var($v, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_BACKTICK);
//now replace the placeholder with the original newline
$_POST[$k] = str_replace("[NEWLINE]","\n",$v);
}
//simple form for testing submital
?><!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Filter test</title>
</head>
<body>
<form action="" method="post">
<p>
<textarea name="ta1" cols="30" rows="10"><?php echo $_POST['ta1']; ?></textarea>
</p>
<p>
<input type="text" name="txt1" size="30" value="<?php echo $_POST['txt1']; ?>" />
</p>
<p>
<input type="submit" />
</p>
</form>
</body>
</html>
david dot drakulovski at gmail dot com ¶
8 years ago
Here is a simpler and a better presented ASCII list for the <32 or 127> filters
(if wikipedia confused the hell out of you):
http://www.danshort.com/ASCIImap/
adellemfrank at hotmail dot com ¶
9 years ago
A good list of which ASCII characters are < 32 and > 127 can be found at: http://en.wikipedia.org/wiki/ASCII#ASCII_printable_characters
Anonymous ¶
1 year ago
<?php
/*
filter all ascii and save juste 0-9 a-Z and @ . _
*/
echo alphanum('abcdefghABCDEFGH0123456789/!:;@._');
// return abcdefghABCDEFGH0123456789@._
function alphanum( $string , $x=''){
$h=strlen($string);
for($a=0; $a<$h; $a++) {
$i = ord($string[$a]);
if(
($i==46) || // .
($i==64) || // @
($i==95) || // _
($i > 47 && $i < 58) || //0123456789
($i > 64 && $i < 91) || //ABCDEFGH..Z
($i > 96 && $i < 123) //abcdefgh..z
) { $x .= $string[$a]; }
}
return $x;
}
?>
Rodrigo Guariento ¶
2 years ago
To get ONLY numbers from a string use this code:
echo preg_replace('/[^0-9]/', '', '123456-789');
anonymous ¶
2 years ago
In the "FILTER_SANITIZE_URL" section where it says, "Remove all characters except letters, digits and $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=." is there a reason why there is a double backslash (\\)? Shouldn't there only be one backslash if it's saying that backslashes are allowed?
scamber256 at hotmail dot de ¶
10 years ago
Just a hint I tested,
You can obtain all the chars <32 (so newline and c.return), by using not operator > !FILTER_FLAG_STRIP_LOW as the last argument.
Example:
filter_input(INPUT_GET,'test',FILTER_SANITIZE_STRING,!FILTER_FLAG_STRIP_LOW);
The filter keeps working as before removing anything else as before apart from FILTER_FLAG_STRIP_LOW.
Just filter those "bad" chars <32 manually you don't want.
googlybash24 at aol dot com ¶
9 years ago
This should help with most simple "textarea" fields in post forms.
Removing user html tags while maintaining text formatting such as newlines and carriage returns involves using the FILTER_SANITIZE_STRING filter ID with the flag !FILTER_FLAG_STRIP_LOW. The formatting text (the low ASCII values under decimal 32) are encoded because of the included FILTER_FLAG_ENCODE_LOW flag, but you are now preventing these from being removed. When you want to display the value on the page back in its intended format, use nl2br() so the encoded newlines are formatted properly on the page.
This example cleans $_POST data from a textarea field with the name "user_tasks" on a previous html form, stripping tags but maintaining formatting (at least for newlines):
<?php
$postfilter =
array(
'user_tasks' => array('filter' => FILTER_SANITIZE_STRING, 'flags' => !FILTER_FLAG_STRIP_LOW), // removes tags. formatting code is encoded -- add nl2br() when displaying
);
$revised_post_array = filter_input_array(INPUT_POST, $postfilter); // must be referenced via a variable which is now an array that takes the place of $_POST[]
echo (nl2br($revised_post_array['user_tasks'])); // here we use nl2br() for the displayed value, for the ['user_tasks'] array value so that the newlines are formatted
?>
Ruth ¶
6 years ago
This is an example for a form having a group of checkboxes besides a lot of other inputs:
$args = array(
'details' => array(
'name' => 'details[]',
'filter' => FILTER_SANITIZE_STRING,
'flags' => FILTER_REQUIRE_ARRAY
)
// ,
// a lot of other stuff here (all the form’s elements)
);
$myInputs = filter_input_array( INPUT_GET, $args, true );
where the checkboxes are (their form is in a page that reloads itself):
<label>
<input type="checkbox" name="details[]" value=“A” <?php if (in_array( “A”, $myInputs['details'] )) { echo 'checked'; } ?>>
Show A
</label>
<label>
<input type="checkbox" name="details[]" value=“B” <?php if (in_array( “B”, $myInputs['details'] )) { echo 'checked'; } ?>>
Show B
</label>
<label>
<input type="checkbox" name="details[]" value=“C” <?php if (in_array( “C”, $myInputs['details'] )) { echo 'checked'; } ?>>
Show C
</label>
<label>
<input type="checkbox" name="details[]" value=“D” <?php if (in_array( “D”, $myInputs['details'] )) { echo 'checked'; } ?>>
Show D
</label>
Dmitry Snytkine ¶
11 years ago
Beware that FILTER_FLAG_STRIP_LOW strips NEWLINE and TAG and CARRIAGE RETURN chars. If you have a form that accepts user input in plaintext format, all the submitted text will lose all the line breaks, making it appear all on one line. This basically renders this filter useless for parsing user-submitted text, even in plain text.
官方地址：https://www.php.net/manual/en/filter.filters.sanitize.php
IT
PHP
编程语言
Linux
开发编程
科技
Elasticsearch
HTML/CSS/XML
网络
JAVA
NoSQL
数据库
面试
C/C++
Golang
Git
算法
操作系统
正则表达式
Redis
互联网
MySql
JavaScript
运维
软件
国际
架构设计
Mac OS
TCP/IP
Excel
Vim
Windows
Socket
Oracle
VR
MongoDB
Python
运营
MemCache
商业
硬件
电子
娱乐
设计
nginx
摄影
游戏
WordPress
HTTP
团建
数码电器
广告
--
php7 安装fileinfo扩展
preg_split — 通过一个正则表达式分隔字符串
php位值,解决 PHP 中 usort 在值相同时改变原始位置的问题
[PHP] inet_pton/inet_ntop IP地址转换函数
array_multisort() 多字段排序
PHPMailer设置utf8 PHPMailer字符集CharSet
ADORecordSet对象
adodb手册
PHP 8.1
[鸟哥]PHP_INT_MIN 和 -9223372036854775808
opcache预加载
Composer的Packagist资源
mysql面试题
[鸟哥]PHP FFI详解 - 一种全新的PHP扩展方式
PHP7添加redis扩展
PHP mkdir()写出来的权限与mode值不符合
Packagist / Composer 中国全量镜像
php中几种注释规范
PHP获取指定函数定义在哪个文件中及行号
支持php7的性能采集扩展