6

Can someone recommend an up to date library for data Sanitization in PHP ?

I am looking for a library that proposes a set of functions for data sanitization. Email validation/sanitization (remove those %0A, \r...), strip htlm (stripslashes(htmlentities), remove script, SQL injection … any form of exploit related to data submitted by users.

CakePHP sanitization class (not the "framework") looks nice.. ?

1
  • Please define "data sanitization". Are you wanting to remove html entities, just potential xss attacks, or sql injection attacks?
    – rick
    Commented May 8, 2009 at 20:00

6 Answers 6

6

Check out PHP Filter

1
  • 2
    Or directly the official manual entry of PHP's Data Filtering: php.net/filter
    – viam0Zah
    Commented May 8, 2009 at 18:29
1

Zend Filter, Zend Filter Input and Zend_Validate

1
$firstName = $_POST['fname'];
$new_string = filter_var($firstName, FILTER_SANITIZE_STRING);
echo $new_string;
1
  • PHP filters were already posted as an answer.
    – kapa
    Commented Oct 26, 2012 at 8:42
0

CakePHP is a framework, not a sanitation library.

It's probably easier to just write your own sanitization functions.

2
  • I was only going to use the sanitize.php file.
    – Gonzo
    Commented May 8, 2009 at 18:30
  • Fair enough, I didn't follow the link. Commented May 8, 2009 at 18:33
0

There is no such thing as data sanitization. Data isn't dangerous on it self - it's the context in which it's used, that makes it safe or unsafe. That means that it is pointless to try and validate/sanitize data on entry. Instead, your should escape it properly on output. See also my answer here.

2
  • If you need to allow markup in input, but you don't want xss attacks, then it's not "pointless" to validate/sanitize data on entry. Why would you store dangerous input?
    – rick
    Commented May 8, 2009 at 19:58
  • I consider that an edge case and I'd use HtmlPurifier for that.
    – troelskn
    Commented May 8, 2009 at 21:59
0

For filtering out xss attacks when you need to preserve html markup: htmlpurifier

If you don't need to keep html markup, you can use htmlspecialchars or htmlentities