Increasing understanding of validating a string with PHP string functions

Question

I've just started attempts to validate data in PHP and I'm trying to understand this concept better. I was expecting the string passed as an argument to the $data parameter for the test_input() function to be formatted by the following PHP functions.

trim() to remove white space from the end of the string
stripslashes() to return a string with backslashes stripped off
htmlspecialchars() to convert special characters to HTML entities

The issue is that the string that I am echoing at the end of the function is not being formatted in the way I desire at all. In fact it looks exactly the same when I run this code on my server - no white space removed, the backslash is not stripped and no special characters converted to HTML entities.

My question is have I gone about this in the wrong approach? Should I be creating the variable called $santised_input on 3 separate lines with each of the functions trim(), stripslashes() and htmlspecialchars()?

By my understanding surely I am overwriting the value of the $santised_input variable each time I recreate it on a new line of code. Therefore the trim() and stripslashes() string functions will never be executed.

What I am trying to achieve is using the "$santised_input" variable to run all of these PHP string functions when the $data argument is passed to my test_input() function. In other words can these string functions be chained together so that I only need to create $santised_input once?

<?php

function test_input($data) {
   $santised_input = trim($data);
   $santised_input = stripslashes($data);
   $santised_input = htmlspecialchars($data);
   echo $santised_input;
}

test_input("%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E\     ");

//Does not output desired result "&quot;&gt;&lt;script&gt;alert('hacked')&lt;/script&gt;"

?>

Pudge601 · Accepted Answer · 2014-05-29 15:08:56Z

6

You're performing each of the string functions on the original $data variable, and overwriting the value of $santised_input each time. The output will be no different from simply running the last string function and neither of the first two.

To solve, perform the latter functions on the $santised_input variable;

function test_input($data) {
   $santised_input = trim($data);
   $santised_input = stripslashes($santised_input);
   $santised_input = htmlspecialchars($santised_input);
   echo $santised_input;
}

answered May 29, 2014 at 15:08

Pudge601

2,0681 gold badge12 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user1554264 Over a year ago

Thanks so much for clearing this up. Please can I ask one final thing? I know now that I was overwriting the value of $santised_input with $data. In the example you have posted we are using $santised_input instead of $number because this variable can store the output and then build on it each time?

Pudge601 Over a year ago

Yeah, the output of the previous function is re-used in the next function each time to get the final result =]

user1554264 Over a year ago

Thanks again, you've really helped me today.

Patrick Q · Accepted Answer · 2014-05-29 15:09:52Z

1

Edit: Sorry, misread the question. You actually can do:

$sanitised_input = htmlspecialchars(stripslashes(trim($data)));

and that should do the trick, i think.

edited May 29, 2014 at 15:09

Patrick Q

6,3942 gold badges28 silver badges34 bronze badges

answered May 29, 2014 at 15:07

nthall

2,9251 gold badge29 silver badges37 bronze badges

Comments

Pablo Ezequiel Leone · Accepted Answer · 2014-05-29 15:23:44Z

0

I never trust in this functions, I'd do with regex using preg_replace.

http://www.php.net/manual/es/function.preg-replace.php

answered May 29, 2014 at 15:23

Pablo Ezequiel Leone

1,39718 silver badges22 bronze badges

Comments

Community · Accepted Answer · 2023-11-17 20:33:26Z

0

You should also be aware of the filtering functions added in PHP 5. filter_var

Strings can be sanitized as follows

$sanitised = filter_var($data, FILTER_SANITIZE_STRING);

There are various options you can use for sanitizing it, for example

$sanitised = filter_var($data, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES);

These functions are particularly useful for validating and sanitizing URLs and emails via FILTER_SANITIZE_URL and FILTER_SANITIZE_EMAIL

edited Nov 17, 2023 at 20:33

CommunityBot

11 silver badge

answered May 29, 2014 at 15:27

Oscar M.

1,0867 silver badges9 bronze badges

Collectives™ on Stack Overflow

Increasing understanding of validating a string with PHP string functions

4 Answers 4

3 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related