Data Sanitization in PHP

Question

Can someone recommend an up to date library for data Sanitization in PHP ?

I am looking for a library that proposes a set of functions for data sanitization. Email validation/sanitization (remove those %0A, \r...), strip htlm (stripslashes(htmlentities), remove script, SQL injection … any form of exploit related to data submitted by users.

CakePHP sanitization class (not the "framework") looks nice.. ?

Please define "data sanitization". Are you wanting to remove html entities, just potential xss attacks, or sql injection attacks? — rick, May 08 '09 at 20:00

score 6 · Accepted Answer · answered May 08 '09 at 18:27

6

Check out PHP Filter

answered May 08 '09 at 18:27

MichaelICE

9,837
19
67
106

2

Or directly the official manual entry of PHP's Data Filtering: http://www.php.net/filter – viam0Zah May 08 '09 at 18:29

score 1 · Answer 2 · answered May 08 '09 at 18:28

1

Zend Filter, Zend Filter Input and Zend_Validate

answered May 08 '09 at 18:28

karim79

334,458
66
409
405

score 1 · Answer 3 · edited Feb 27 '12 at 21:06

1

$firstName = $_POST['fname'];
$new_string = filter_var($firstName, FILTER_SANITIZE_STRING);
echo $new_string;

edited Feb 27 '12 at 21:06

Marvin Pinto

28,922
7
36
53

answered Feb 27 '12 at 10:20

vivek salve

11
1

PHP filters were already posted as an answer. – kapa Oct 26 '12 at 08:42

score 0 · Answer 4 · answered May 08 '09 at 18:27

0

CakePHP is a framework, not a sanitation library.

It's probably easier to just write your own sanitization functions.

answered May 08 '09 at 18:27

Joe Phillips

47,092
28
100
152

I was only going to use the sanitize.php file. – May 08 '09 at 18:30
Fair enough, I didn't follow the link. – Joe Phillips May 08 '09 at 18:33

score 0 · Answer 5 · edited May 23 '17 at 11:53

0

There is no such thing as data sanitization. Data isn't dangerous on it self - it's the context in which it's used, that makes it safe or unsafe. That means that it is pointless to try and validate/sanitize data on entry. Instead, your should escape it properly on output. See also my answer here.

edited May 23 '17 at 11:53

Community

1
1

answered May 08 '09 at 18:39

troelskn

111,113
23
130
153

If you need to allow markup in input, but you don't want xss attacks, then it's not "pointless" to validate/sanitize data on entry. Why would you store dangerous input? – rick May 08 '09 at 19:58
I consider that an edge case and I'd use HtmlPurifier for that. – troelskn May 08 '09 at 21:59

score 0 · Answer 6 · answered May 08 '09 at 20:03

0

For filtering out xss attacks when you need to preserve html markup: htmlpurifier

If you don't need to keep html markup, you can use htmlspecialchars or htmlentities

answered May 08 '09 at 20:03

rick

1,529
10
12

Data Sanitization in PHP

6 Answers6

Linked