From 0b9ab717f14cbcd3eff53032ce32947a2e5b0b8b Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 27 Oct 2024 16:38:24 +0000 Subject: [PATCH 01/11] Organize Filter constants into dedicated lists --- reference/filter/constants.xml | 371 +++++++++++++++++---------------- 1 file changed, 194 insertions(+), 177 deletions(-) diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index bc0139c4611c..99461f0e3758 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -4,7 +4,9 @@ &reftitle.constants; &extension.constants; + + Input Constants INPUT_POST @@ -84,6 +86,10 @@ + + + + Filter Flags FILTER_FLAG_NONE @@ -95,592 +101,603 @@ - + - FILTER_REQUIRE_SCALAR + FILTER_NULL_ON_FAILURE (int) - Flag used to require scalar as input + Use NULL instead of FALSE on failure. - + - FILTER_REQUIRE_ARRAY + FILTER_REQUIRE_SCALAR (int) - Require an array as input. + Flag used to require scalar as input - + - FILTER_FORCE_ARRAY + FILTER_REQUIRE_ARRAY (int) - Always returns an array. + Require an array as input. - + - FILTER_NULL_ON_FAILURE + FILTER_FORCE_ARRAY (int) - Use NULL instead of FALSE on failure. + Always returns an array. - + - FILTER_VALIDATE_INT + FILTER_FLAG_ALLOW_OCTAL (int) - ID of "int" filter. + Allow octal notation (0[0-7]+) in "int" filter. - + - FILTER_VALIDATE_BOOL + FILTER_FLAG_ALLOW_HEX (int) - Alias of FILTER_VALIDATE_BOOLEAN. + Allow hex notation (0x[0-9a-fA-F]+) in "int" filter. - + - FILTER_VALIDATE_BOOLEAN + FILTER_FLAG_STRIP_LOW (int) - ID of "boolean" filter. + Strip characters with ASCII value less than 32. - + - FILTER_VALIDATE_FLOAT + FILTER_FLAG_STRIP_HIGH (int) - ID of "float" filter. + Strip characters with ASCII value greater than 127. - + - FILTER_VALIDATE_REGEXP + FILTER_FLAG_STRIP_BACKTICK (int) - ID of "validate_regexp" filter. + Strips backtick characters. - + - FILTER_VALIDATE_URL + FILTER_FLAG_ENCODE_LOW (int) - ID of "validate_url" filter. + Encode characters with ASCII value less than 32. - + - FILTER_VALIDATE_DOMAIN + FILTER_FLAG_ENCODE_HIGH (int) - ID of "validate_domain" filter. - (Available as of PHP 7.0.0) + Encode characters with ASCII value greater than 127. - + - FILTER_VALIDATE_EMAIL + FILTER_FLAG_ENCODE_AMP (int) - ID of "validate_email" filter. + Encode &. - + - FILTER_VALIDATE_IP + FILTER_FLAG_NO_ENCODE_QUOTES (int) - ID of "validate_ip" filter. + Don't encode ' and ". - + - FILTER_VALIDATE_MAC + FILTER_FLAG_EMPTY_STRING_NULL (int) - ID of "validate_mac_address" filter. + (No use for now.) - + - FILTER_DEFAULT + FILTER_FLAG_ALLOW_FRACTION (int) - ID of default ("unsafe_raw") filter. This is equivalent to - FILTER_UNSAFE_RAW. + Allow fractional part in "number_float" filter. - + - FILTER_UNSAFE_RAW + FILTER_FLAG_ALLOW_THOUSAND (int) - ID of "unsafe_raw" filter. + Allow thousand separator (,) in "number_float" filter. - + - FILTER_SANITIZE_STRING + FILTER_FLAG_ALLOW_SCIENTIFIC (int) - ID of "string" filter. - (Deprecated as of PHP 8.1.0, - use htmlspecialchars instead.) + Allow scientific notation (e, E) in + "number_float" filter. - + - FILTER_SANITIZE_STRIPPED + FILTER_FLAG_PATH_REQUIRED (int) - ID of "stripped" filter. - (Deprecated as of PHP 8.1.0, - use htmlspecialchars instead.) + Require path in "validate_url" filter. - + - FILTER_SANITIZE_ENCODED + FILTER_FLAG_QUERY_REQUIRED (int) - ID of "encoded" filter. + Require query in "validate_url" filter. - + - FILTER_SANITIZE_SPECIAL_CHARS + FILTER_FLAG_SCHEME_REQUIRED (int) - ID of "special_chars" filter. + Require scheme in "validate_url" filter. + (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied in the filter already.) - + - FILTER_SANITIZE_FULL_SPECIAL_CHARS + FILTER_FLAG_HOST_REQUIRED (int) - ID of "full_special_chars" filter. + Require host in "validate_url" filter. + (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied in the filter already.) - + - FILTER_SANITIZE_EMAIL + FILTER_FLAG_HOSTNAME (int) - ID of "email" filter. + Require hostnames to start with an alphanumeric character and contain + only alphanumerics or hyphens. + (Available as of PHP 7.0.0) - + - FILTER_SANITIZE_URL + FILTER_FLAG_IPV4 (int) - ID of "url" filter. + Allow only IPv4 address in "validate_ip" filter. - + - FILTER_SANITIZE_NUMBER_INT + FILTER_FLAG_IPV6 (int) - ID of "number_int" filter. + Allow only IPv6 address in "validate_ip" filter. - + - FILTER_SANITIZE_NUMBER_FLOAT + FILTER_FLAG_NO_RES_RANGE (int) - ID of "number_float" filter. + Deny reserved addresses in "validate_ip" filter. - + - FILTER_SANITIZE_MAGIC_QUOTES - (int) + FILTER_FLAG_NO_PRIV_RANGE + (int) - ID of "magic_quotes" filter. - (DEPRECATED as of PHP 7.3.0 and - REMOVED as of PHP 8.0.0, - use FILTER_SANITIZE_ADD_SLASHES instead.) + Deny private addresses in "validate_ip" filter. - + - FILTER_SANITIZE_ADD_SLASHES + FILTER_FLAG_GLOBAL_RANGE (int) - ID of "add_slashes" filter. - (Available as of PHP 7.3.0) + Only allow global addresses (per RFC 6890) in "validate_ip" filter. + (Available as of PHP 8.2.0) - + - FILTER_CALLBACK + FILTER_FLAG_EMAIL_UNICODE (int) - ID of "callback" filter. + Accepts Unicode characters in the local part in "validate_email" filter. + (Available as of PHP 7.1.0) - + + + + Validation Filters + - FILTER_FLAG_ALLOW_OCTAL + FILTER_VALIDATE_INT (int) - Allow octal notation (0[0-7]+) in "int" filter. + ID of "int" filter. - + - FILTER_FLAG_ALLOW_HEX + FILTER_VALIDATE_BOOL (int) - Allow hex notation (0x[0-9a-fA-F]+) in "int" filter. + Alias of FILTER_VALIDATE_BOOLEAN. - + - FILTER_FLAG_STRIP_LOW + FILTER_VALIDATE_BOOLEAN (int) - Strip characters with ASCII value less than 32. + ID of "boolean" filter. - + - FILTER_FLAG_STRIP_HIGH + FILTER_VALIDATE_FLOAT (int) - Strip characters with ASCII value greater than 127. + ID of "float" filter. - + - FILTER_FLAG_STRIP_BACKTICK + FILTER_VALIDATE_REGEXP (int) - Strips backtick characters. + ID of "validate_regexp" filter. - + - FILTER_FLAG_ENCODE_LOW + FILTER_VALIDATE_URL (int) - Encode characters with ASCII value less than 32. + ID of "validate_url" filter. - + - FILTER_FLAG_ENCODE_HIGH + FILTER_VALIDATE_DOMAIN (int) - Encode characters with ASCII value greater than 127. + ID of "validate_domain" filter. + (Available as of PHP 7.0.0) - + - FILTER_FLAG_ENCODE_AMP + FILTER_VALIDATE_EMAIL (int) - Encode &. + ID of "validate_email" filter. - + - FILTER_FLAG_NO_ENCODE_QUOTES + FILTER_VALIDATE_IP (int) - Don't encode ' and ". + ID of "validate_ip" filter. - + - FILTER_FLAG_EMPTY_STRING_NULL + FILTER_VALIDATE_MAC (int) - (No use for now.) + ID of "validate_mac_address" filter. - + + + + Sanitizing Filters + - FILTER_FLAG_ALLOW_FRACTION + FILTER_DEFAULT (int) - Allow fractional part in "number_float" filter. + ID of default ("unsafe_raw") filter. This is equivalent to + FILTER_UNSAFE_RAW. - + - FILTER_FLAG_ALLOW_THOUSAND + FILTER_UNSAFE_RAW (int) - Allow thousand separator (,) in "number_float" filter. + ID of "unsafe_raw" filter. - + - FILTER_FLAG_ALLOW_SCIENTIFIC + FILTER_SANITIZE_STRING (int) - Allow scientific notation (e, E) in - "number_float" filter. + ID of "string" filter. + (Deprecated as of PHP 8.1.0, + use htmlspecialchars instead.) - + - FILTER_FLAG_PATH_REQUIRED + FILTER_SANITIZE_STRIPPED (int) - Require path in "validate_url" filter. + ID of "stripped" filter. + (Deprecated as of PHP 8.1.0, + use htmlspecialchars instead.) - + - FILTER_FLAG_QUERY_REQUIRED + FILTER_SANITIZE_ENCODED (int) - Require query in "validate_url" filter. + ID of "encoded" filter. - + - FILTER_FLAG_SCHEME_REQUIRED - (int) + FILTER_SANITIZE_SPECIAL_CHARS + (int) - Require scheme in "validate_url" filter. - (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied in the filter already.) + ID of "special_chars" filter. - + - FILTER_FLAG_HOST_REQUIRED - (int) + FILTER_SANITIZE_FULL_SPECIAL_CHARS + (int) - Require host in "validate_url" filter. - (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied in the filter already.) + ID of "full_special_chars" filter. - + - FILTER_FLAG_HOSTNAME + FILTER_SANITIZE_EMAIL (int) - Require hostnames to start with an alphanumeric character and contain - only alphanumerics or hyphens. - (Available as of PHP 7.0.0) + ID of "email" filter. - + - FILTER_FLAG_IPV4 + FILTER_SANITIZE_URL (int) - Allow only IPv4 address in "validate_ip" filter. + ID of "url" filter. - + - FILTER_FLAG_IPV6 + FILTER_SANITIZE_NUMBER_INT (int) - Allow only IPv6 address in "validate_ip" filter. + ID of "number_int" filter. - + - FILTER_FLAG_NO_RES_RANGE + FILTER_SANITIZE_NUMBER_FLOAT (int) - Deny reserved addresses in "validate_ip" filter. + ID of "number_float" filter. - + - FILTER_FLAG_NO_PRIV_RANGE - (int) + FILTER_SANITIZE_MAGIC_QUOTES + (int) - Deny private addresses in "validate_ip" filter. + ID of "magic_quotes" filter. + (DEPRECATED as of PHP 7.3.0 and + REMOVED as of PHP 8.0.0, + use FILTER_SANITIZE_ADD_SLASHES instead.) - + - FILTER_FLAG_GLOBAL_RANGE + FILTER_SANITIZE_ADD_SLASHES (int) - Only allow global addresses (per RFC 6890) in "validate_ip" filter. - (Available as of PHP 8.2.0) + ID of "add_slashes" filter. + (Available as of PHP 7.3.0) - + + + User Defined Filter + - FILTER_FLAG_EMAIL_UNICODE + FILTER_CALLBACK (int) - Accepts Unicode characters in the local part in "validate_email" filter. - (Available as of PHP 7.1.0) + ID of "callback" filter. From 2526d39218a5f1a433f3599c04bb0d60ee461682 Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 27 Oct 2024 16:39:17 +0000 Subject: [PATCH 02/11] Add a TODO --- reference/filter/constants.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index 99461f0e3758..4e35c462571a 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -696,6 +696,8 @@ (int) + ID of "callback" filter. From 611dd2d49acc5a70cfd77f25cc60d6f9bd5e3a53 Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 27 Oct 2024 17:58:06 +0000 Subject: [PATCH 03/11] Group validation filters somewhat --- reference/filter/constants.xml | 403 +++++++++++++++++++-------------- 1 file changed, 238 insertions(+), 165 deletions(-) diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index 4e35c462571a..fd1d357aebec 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -7,6 +7,11 @@ Input Constants + + These constants are used by + filter_input and + filter_input_array. + INPUT_POST @@ -88,7 +93,7 @@ - + Filter Flags @@ -108,7 +113,12 @@ - Use NULL instead of FALSE on failure. + Use &null; instead of &false; on failure. + + + Usable with any + FILTER_VALIDATE_* + filter. @@ -119,7 +129,7 @@ - Flag used to require scalar as input + Flag used to require the input of the filter to be a scalar. @@ -130,7 +140,7 @@ - Require an array as input. + Flag used to require the input of the filter to be an array. @@ -141,32 +151,221 @@ - Always returns an array. - - - - - - FILTER_FLAG_ALLOW_OCTAL - (int) - - - - Allow octal notation (0[0-7]+) in "int" filter. - - - - - - FILTER_FLAG_ALLOW_HEX - (int) - - - - Allow hex notation (0x[0-9a-fA-F]+) in "int" filter. + This flags wraps scalar inputs into a one element array + for filters which operate on arrays. + + + Flags for the <constant>FILTER_VALIDATE_DOMAIN</constant> filter + + + FILTER_FLAG_HOSTNAME + (int) + + + + Require hostnames to start with an alphanumeric character and contain + only alphanumerics or hyphens. + + + + + + + Flags for the <constant>FILTER_VALIDATE_EMAIL</constant> filter + + + FILTER_FLAG_EMAIL_UNICODE + (int) + + + + Accepts Unicode characters in the local part. + Available as of PHP 7.1.0. + + + + + + + Flags for the <constant>FILTER_VALIDATE_INT</constant> filter + + + FILTER_FLAG_ALLOW_OCTAL + (int) + + + + + Allow integers in octal notation + (0[0-7]+). + + + + + + FILTER_FLAG_ALLOW_HEX + (int) + + + + Allow integers in hexadecimal notation + (0x[0-9a-fA-F]+). + + + + + + + Flags for the <constant>FILTER_VALIDATE_IP</constant> filter + + + FILTER_FLAG_IPV4 + (int) + + + + Allow IPv4 address. + + + + + + FILTER_FLAG_IPV6 + (int) + + + + Allow IPv6 address. + + + + + + FILTER_FLAG_NO_RES_RANGE + (int) + + + + Deny reserved addresses. + + + These are the ranges that are marked as + Reserved-By-Protocol in + RFC 6890. + + + Which for IPv4 corresponds to the following ranges: + + 0.0.0.0/8 + 169.254.0.0/16 + 127.0.0.0/8 + 240.0.0.0/4 + . + + + And for IPv6 corresponds to the following ranges: + + ::1/128 + ::/128 + ::FFFF:0:0/96 + FE80::/10 + . + + + + + + FILTER_FLAG_NO_PRIV_RANGE + (int) + + + + Deny private addresses. + + + These are IPv4 addresses which are in the following ranges: + + 10.0.0.0/8 + 172.16.0.0/12 + 192.168.0.0/16 + . + + + These are IPv6 addresses starting with + FD or FC. + + + + + + FILTER_FLAG_GLOBAL_RANGE + (int) + + + + Only allow global addresses. + These can be found in + RFC 6890 + where the Global attribute is True. + Available as of PHP 8.2.0. + + + + + + + Flags for the <constant>FILTER_VALIDATE_URL</constant> filter + + + FILTER_FLAG_SCHEME_REQUIRED + (int) + + + + Requires the URL to contain a scheme part. + (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied by the filter already.) + + + + + + FILTER_FLAG_HOST_REQUIRED + (int) + + + + Requires the URL to contain a host part. + (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied by the filter already.) + + + + + + FILTER_FLAG_PATH_REQUIRED + (int) + + + + Requires the URL to contain a path part. + + + + + + FILTER_FLAG_QUERY_REQUIRED + (int) + + + + Requires the URL to contain a query part. + + + + + FILTER_FLAG_STRIP_LOW @@ -251,10 +450,13 @@ - (No use for now.) + + If sanitizing a string results in an empty string, + convert the value to &null; + FILTER_FLAG_ALLOW_FRACTION @@ -289,133 +491,6 @@ - - - FILTER_FLAG_PATH_REQUIRED - (int) - - - - Require path in "validate_url" filter. - - - - - - FILTER_FLAG_QUERY_REQUIRED - (int) - - - - Require query in "validate_url" filter. - - - - - - FILTER_FLAG_SCHEME_REQUIRED - (int) - - - - Require scheme in "validate_url" filter. - (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied in the filter already.) - - - - - - FILTER_FLAG_HOST_REQUIRED - (int) - - - - Require host in "validate_url" filter. - (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied in the filter already.) - - - - - - FILTER_FLAG_HOSTNAME - (int) - - - - Require hostnames to start with an alphanumeric character and contain - only alphanumerics or hyphens. - (Available as of PHP 7.0.0) - - - - - - FILTER_FLAG_IPV4 - (int) - - - - Allow only IPv4 address in "validate_ip" filter. - - - - - - FILTER_FLAG_IPV6 - (int) - - - - Allow only IPv6 address in "validate_ip" filter. - - - - - - FILTER_FLAG_NO_RES_RANGE - (int) - - - - Deny reserved addresses in "validate_ip" filter. - - - - - - FILTER_FLAG_NO_PRIV_RANGE - (int) - - - - Deny private addresses in "validate_ip" filter. - - - - - - FILTER_FLAG_GLOBAL_RANGE - (int) - - - - Only allow global addresses (per RFC 6890) in "validate_ip" filter. - (Available as of PHP 8.2.0) - - - - - - FILTER_FLAG_EMAIL_UNICODE - (int) - - - - Accepts Unicode characters in the local part in "validate_email" filter. - (Available as of PHP 7.1.0) - - - @@ -438,7 +513,7 @@ - Alias of FILTER_VALIDATE_BOOLEAN. + ID of "boolean" filter. @@ -449,7 +524,7 @@ - ID of "boolean" filter. + Alias of FILTER_VALIDATE_BOOL. @@ -494,7 +569,6 @@ ID of "validate_domain" filter. - (Available as of PHP 7.0.0) @@ -535,26 +609,25 @@ Sanitizing Filters - + - FILTER_DEFAULT + FILTER_UNSAFE_RAW (int) - ID of default ("unsafe_raw") filter. This is equivalent to - FILTER_UNSAFE_RAW. + ID of "unsafe_raw" filter. - + - FILTER_UNSAFE_RAW + FILTER_DEFAULT (int) - ID of "unsafe_raw" filter. + Alias of FILTER_UNSAFE_RAW. From 230709d12fbe5dabc524cdac3252ee7960c24d7c Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 27 Oct 2024 18:22:52 +0000 Subject: [PATCH 04/11] Start describing some filters --- reference/filter/constants.xml | 101 +++++++++++++++++++++++++++------ 1 file changed, 85 insertions(+), 16 deletions(-) diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index fd1d357aebec..88496b218adc 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -495,36 +495,51 @@ Validation Filters - + - FILTER_VALIDATE_INT + FILTER_VALIDATE_BOOL (int) - ID of "int" filter. + Returns &true; for "1", + "true", + "on", + and "yes". + + + Returns &false; for "0", + "false", + "off", + "no", and + "". + + + The return value for non-boolean values depends on the + FILTER_NULL_ON_FAILURE. + If it is set, &null; is returned, otherwise &false; is returned. - + - FILTER_VALIDATE_BOOL + FILTER_VALIDATE_BOOLEAN (int) - ID of "boolean" filter. + Alias of FILTER_VALIDATE_BOOL. - + - FILTER_VALIDATE_BOOLEAN + FILTER_VALIDATE_INT (int) - Alias of FILTER_VALIDATE_BOOL. + ID of "int" filter. @@ -557,8 +572,29 @@ - ID of "validate_url" filter. + Validates whether the URL name is valid according to + &url.rfc;2396. + + Accepts the following additional flags for more granular behaviour: + + FILTER_FLAG_PATH_REQUIRED + FILTER_FLAG_QUERY_REQUIRED + + + + + A valid URL may not specify the + HTTP protocol (http://). + Therefore, further validation may be required to determine if the + URL uses an expected protocol, + e.g. ssh:// or mailto:. + + + + This filter only works on ASCII URLs. + This means that internationalized domain names will always be rejected. + @@ -568,7 +604,19 @@ - ID of "validate_domain" filter. + Validates whether the domain name is valid according to + RFC 952, + RFC 1034, + RFC 1035, + RFC 1123, + RFC 2732, + and + RFC 2181. + + + The optional flag + FILTER_FLAG_HOSTNAME + allows validating hostnames in particular. @@ -579,8 +627,21 @@ - ID of "validate_email" filter. + Validates whether the value is a "valid" e-mail address. + + + The validation is performed against the addr-spec + syntax in + RFC 822. + However, comments, whitespace folding, and dotless domain names + are not supported, and thus will be rejected. + + + Email validation is complex and the only true way to confirm an email + is valid and exists is to send an email to the address. + + @@ -589,9 +650,17 @@ (int) - - ID of "validate_ip" filter. - + + Validates value as IP address. + Accepts the following additional flags for more granular behaviour: + + FILTER_FLAG_IPV4 + FILTER_FLAG_IPV6 + FILTER_FLAG_NO_PRIV_RANGE + FILTER_FLAG_NO_RES_RANGE + FILTER_FLAG_GLOBAL_RANGE + + @@ -601,7 +670,7 @@ - ID of "validate_mac_address" filter. + Validates whether the value is a MAC address. From 0a78f53237b42efaa3dad386bc4dd01aa841cc66 Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 27 Oct 2024 18:37:41 +0000 Subject: [PATCH 05/11] Add XLink --- reference/filter/constants.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index 88496b218adc..f19973881360 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -1,7 +1,7 @@ - + &reftitle.constants; &extension.constants; From 6ab1e5f55c41a68b90c37e81e83fdb080769a401 Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 27 Oct 2024 19:32:25 +0000 Subject: [PATCH 06/11] Move Validation filter documentation to constants. --- reference/filter/book.xml | 2 +- reference/filter/constants.xml | 680 +++++++++++++++++++++------------ reference/filter/filters.xml | 429 +-------------------- 3 files changed, 430 insertions(+), 681 deletions(-) diff --git a/reference/filter/book.xml b/reference/filter/book.xml index 8b0b12670a52..4865317e16b0 100644 --- a/reference/filter/book.xml +++ b/reference/filter/book.xml @@ -18,7 +18,7 @@ validation and sanitization. - Validation is used to + Validation is used to validate or check if the data meets certain qualifications. For example, passing in FILTER_VALIDATE_EMAIL will determine if the data is a valid email address, but will not change the data itself. diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index f19973881360..d3d183939b76 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -106,22 +106,6 @@ - - - FILTER_NULL_ON_FAILURE - (int) - - - - Use &null; instead of &false; on failure. - - - Usable with any - FILTER_VALIDATE_* - filter. - - - FILTER_REQUIRE_SCALAR @@ -156,215 +140,22 @@ - - - Flags for the <constant>FILTER_VALIDATE_DOMAIN</constant> filter - - - FILTER_FLAG_HOSTNAME - (int) - - - - Require hostnames to start with an alphanumeric character and contain - only alphanumerics or hyphens. - - - - - - - Flags for the <constant>FILTER_VALIDATE_EMAIL</constant> filter - - - FILTER_FLAG_EMAIL_UNICODE - (int) - - - - Accepts Unicode characters in the local part. - Available as of PHP 7.1.0. - - - - - - - Flags for the <constant>FILTER_VALIDATE_INT</constant> filter - - - FILTER_FLAG_ALLOW_OCTAL - (int) - - - - - Allow integers in octal notation - (0[0-7]+). - - - - - - FILTER_FLAG_ALLOW_HEX - (int) - - - - Allow integers in hexadecimal notation - (0x[0-9a-fA-F]+). - - - - - - - Flags for the <constant>FILTER_VALIDATE_IP</constant> filter - - - FILTER_FLAG_IPV4 - (int) - - - - Allow IPv4 address. - - - - - - FILTER_FLAG_IPV6 - (int) - - - - Allow IPv6 address. - - - - - - FILTER_FLAG_NO_RES_RANGE - (int) - - - - Deny reserved addresses. - - - These are the ranges that are marked as - Reserved-By-Protocol in - RFC 6890. - - - Which for IPv4 corresponds to the following ranges: - - 0.0.0.0/8 - 169.254.0.0/16 - 127.0.0.0/8 - 240.0.0.0/4 - . - - - And for IPv6 corresponds to the following ranges: - - ::1/128 - ::/128 - ::FFFF:0:0/96 - FE80::/10 - . - - - - - - FILTER_FLAG_NO_PRIV_RANGE - (int) - - - - Deny private addresses. - - - These are IPv4 addresses which are in the following ranges: - - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - . - - - These are IPv6 addresses starting with - FD or FC. - - - - - - FILTER_FLAG_GLOBAL_RANGE - (int) - - - - Only allow global addresses. - These can be found in - RFC 6890 - where the Global attribute is True. - Available as of PHP 8.2.0. - - - - - - - Flags for the <constant>FILTER_VALIDATE_URL</constant> filter - - - FILTER_FLAG_SCHEME_REQUIRED - (int) - - - - Requires the URL to contain a scheme part. - (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied by the filter already.) - - - - - - FILTER_FLAG_HOST_REQUIRED - (int) - - - - Requires the URL to contain a host part. - (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied by the filter already.) - - - - - - FILTER_FLAG_PATH_REQUIRED - (int) - - - - Requires the URL to contain a path part. - - - - - - FILTER_FLAG_QUERY_REQUIRED - (int) - - - - Requires the URL to contain a query part. - - - - + + + FILTER_NULL_ON_FAILURE + (int) + + + + Use &null; instead of &false; on failure. + + + Usable with any + FILTER_VALIDATE_* + filter. + + + @@ -493,8 +284,9 @@ - + Validation Filters + FILTER_VALIDATE_BOOL @@ -519,8 +311,23 @@ FILTER_NULL_ON_FAILURE. If it is set, &null; is returned, otherwise &false; is returned. + + Available options + + default + + + Value to return in case the filter fails. + + + + + + Available as of PHP 8.0.0. + + FILTER_VALIDATE_BOOLEAN @@ -529,9 +336,12 @@ Alias of FILTER_VALIDATE_BOOL. + The alias was available prior to the introduction of its canonical + name in PHP 8.0.0. + FILTER_VALIDATE_INT @@ -539,10 +349,75 @@ - ID of "int" filter. + Validates whether the value is an integer, + on success it is converted to type int. + + + + String values are trimmed using trim + before validation. + + + + + Available options + + default + + + Value to return in case the filter fails. + + + + + min_range + + + Value is only valid if it is greater than or equal to the provided value. + + + + + max_range + + + Value is only valid if it is less than or equal to the provided value. + + + + + + Optional Flags + + + FILTER_FLAG_ALLOW_OCTAL + (int) + + + + + Allow integers in octal notation + (0[0-7]+). + + + + + + FILTER_FLAG_ALLOW_HEX + (int) + + + + Allow integers in hexadecimal notation + (0x[0-9a-fA-F]+). + + + + + FILTER_VALIDATE_FLOAT @@ -550,8 +425,68 @@ - ID of "float" filter. + Validates whether the value is a float, + on success it is converted to type float. + + + + String values are trimmed using trim + before validation. + + + + + Available options + + default + + + Value to return in case the filter fails. + + + + + decimal + + + + + + + + min_range + + + Value is only valid if it is greater than or equal to the provided value. + Available as of PHP 7.4.0. + + + + + max_range + + + Value is only valid if it is less than or equal to the provided value. + Available as of PHP 7.4.0. + + + + + + Optional Flags + + + FILTER_FLAG_ALLOW_THOUSAND + (int) + + + + + + + + @@ -561,10 +496,32 @@ - ID of "validate_regexp" filter. + Validates value against the regular expression provided by the + regexp option. + + + Available options + + default + + + Value to return in case the filter fails. + + + + + regexp + + + Perl-compatible regular expression. + + + + + FILTER_VALIDATE_URL @@ -575,13 +532,66 @@ Validates whether the URL name is valid according to &url.rfc;2396. - - Accepts the following additional flags for more granular behaviour: - - FILTER_FLAG_PATH_REQUIRED - FILTER_FLAG_QUERY_REQUIRED - - + + Available options + + default + + + Value to return in case the filter fails. + + + + + + Optional Flags + + + FILTER_FLAG_SCHEME_REQUIRED + (int) + + + + Requires the URL to contain a scheme part. + (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied by the filter already.) + + + + + + FILTER_FLAG_HOST_REQUIRED + (int) + + + + Requires the URL to contain a host part. + (Deprecated as of PHP 7.3.0 and removed as of PHP 8.0.0, as it is implied by the filter already.) + + + + + + FILTER_FLAG_PATH_REQUIRED + (int) + + + + Requires the URL to contain a path part. + + + + + + FILTER_FLAG_QUERY_REQUIRED + (int) + + + + Requires the URL to contain a query part. + + + + A valid URL may not specify the @@ -592,8 +602,10 @@ - This filter only works on ASCII URLs. - This means that internationalized domain names will always be rejected. + + This filter only works on ASCII URLs. + This means that internationalized domain names will always be rejected. + @@ -613,11 +625,32 @@ and RFC 2181. - - The optional flag - FILTER_FLAG_HOSTNAME - allows validating hostnames in particular. - + + Available options + + default + + + Value to return in case the filter fails. + + + + + + Optional Flags + + + FILTER_FLAG_HOSTNAME + (int) + + + + Require hostnames to start with an alphanumeric character and contain + only alphanumerics or hyphens. + + + + @@ -629,6 +662,7 @@ Validates whether the value is a "valid" e-mail address. + The validation is performed against the addr-spec syntax in @@ -636,6 +670,34 @@ However, comments, whitespace folding, and dotless domain names are not supported, and thus will be rejected. + + + Available options + + default + + + Value to return in case the filter fails. + + + + + + Optional Flags + + + FILTER_FLAG_EMAIL_UNICODE + (int) + + + + Accepts Unicode characters in the local part. + Available as of PHP 7.1.0. + + + + + Email validation is complex and the only true way to confirm an email @@ -644,6 +706,7 @@ + FILTER_VALIDATE_IP @@ -652,17 +715,118 @@ Validates value as IP address. - Accepts the following additional flags for more granular behaviour: - - FILTER_FLAG_IPV4 - FILTER_FLAG_IPV6 - FILTER_FLAG_NO_PRIV_RANGE - FILTER_FLAG_NO_RES_RANGE - FILTER_FLAG_GLOBAL_RANGE - + + Available options + + default + + + Value to return in case the filter fails. + + + + + + Optional Flags + + + FILTER_FLAG_IPV4 + (int) + + + + Allow IPv4 address. + + + + + + FILTER_FLAG_IPV6 + (int) + + + + Allow IPv6 address. + + + + + + FILTER_FLAG_NO_RES_RANGE + (int) + + + + Deny reserved addresses. + + + These are the ranges that are marked as + Reserved-By-Protocol in + RFC 6890. + + + Which for IPv4 corresponds to the following ranges: + + 0.0.0.0/8 + 169.254.0.0/16 + 127.0.0.0/8 + 240.0.0.0/4 + . + + + And for IPv6 corresponds to the following ranges: + + ::1/128 + ::/128 + ::FFFF:0:0/96 + FE80::/10 + . + + + + + + FILTER_FLAG_NO_PRIV_RANGE + (int) + + + + Deny private addresses. + + + These are IPv4 addresses which are in the following ranges: + + 10.0.0.0/8 + 172.16.0.0/12 + 192.168.0.0/16 + . + + + These are IPv6 addresses starting with + FD or FC. + + + + + + FILTER_FLAG_GLOBAL_RANGE + (int) + + + + Only allow global addresses. + These can be found in + RFC 6890 + where the Global attribute is True. + Available as of PHP 8.2.0. + + + + + FILTER_VALIDATE_MAC @@ -672,6 +836,18 @@ Validates whether the value is a MAC address. + + + Available options + + default + + + Value to return in case the filter fails. + + + + @@ -720,7 +896,7 @@ - ID of "stripped" filter. + Alias of FILTER_SANITIZE_STRING. (Deprecated as of PHP 8.1.0, use htmlspecialchars instead.) diff --git a/reference/filter/filters.xml b/reference/filter/filters.xml index ad9e6c0f2647..8b1e98fe21b0 100644 --- a/reference/filter/filters.xml +++ b/reference/filter/filters.xml @@ -2,262 +2,7 @@ Types of filters - - -
- Validate filters - - - Listing of filters for validation - - - - ID - Name - Options - Flags - Description - - - - - - FILTER_VALIDATE_BOOLEAN, - FILTER_VALIDATE_BOOL - - "boolean" - - default - - - FILTER_NULL_ON_FAILURE - - - - Returns &true; for "1", "true", "on" and "yes". - Returns &false; otherwise. - - - If FILTER_NULL_ON_FAILURE is set, &false; is - returned only for "0", "false", "off", "no", and "", and - &null; is returned for all non-boolean values. - - - String values are trimmed using trim before comparison. - - - - - FILTER_VALIDATE_DOMAIN - "validate_domain" - - default - - - FILTER_FLAG_HOSTNAME, - FILTER_NULL_ON_FAILURE - - - - Validates whether the domain name label lengths are valid. - - - Validates domain names against RFC 1034, RFC 1035, RFC 952, - RFC 1123, RFC 2732, RFC 2181, and RFC 1123. Optional flag - FILTER_FLAG_HOSTNAME adds ability to - specifically validate hostnames (they must start with an - alphanumeric character and contain only alphanumerics or - hyphens). - - - - - FILTER_VALIDATE_EMAIL - "validate_email" - - default - - - FILTER_FLAG_EMAIL_UNICODE, - FILTER_NULL_ON_FAILURE - - - - Validates whether the value is a valid e-mail address. - - - In general, this validates e-mail addresses against the addr-specsyntax in - RFC 822, with the exceptions that comments and whitespace folding - and dotless domain names - are not supported. - - - - - FILTER_VALIDATE_FLOAT - "float" - - default, - decimal, - min_range, - max_range - - - FILTER_FLAG_ALLOW_THOUSAND, - FILTER_NULL_ON_FAILURE - - - - Validates value as float, optionally from the specified range, and converts to float on success. - - - String values are trimmed using trim before comparison. - - - - - FILTER_VALIDATE_INT - "int" - - default, - min_range, - max_range - - - FILTER_FLAG_ALLOW_OCTAL, - FILTER_FLAG_ALLOW_HEX, - FILTER_NULL_ON_FAILURE - - - - Validates value as integer, optionally from the specified range, and converts to int on success. - - - String values are trimmed using trim before comparison. - - - - - FILTER_VALIDATE_IP - "validate_ip" - - default - - - FILTER_FLAG_IPV4, - FILTER_FLAG_IPV6, - FILTER_FLAG_NO_PRIV_RANGE, - FILTER_FLAG_NO_RES_RANGE, - FILTER_FLAG_GLOBAL_RANGE, - FILTER_NULL_ON_FAILURE - - - Validates value as IP address, optionally only IPv4 or IPv6 or not - from private or reserved ranges. - - - - FILTER_VALIDATE_MAC - "validate_mac_address" - - default - - - FILTER_NULL_ON_FAILURE - - Validates value as MAC address. - - - FILTER_VALIDATE_REGEXP - "validate_regexp" - - default, - regexp - - - FILTER_NULL_ON_FAILURE - - - Validates value against regexp, a - Perl-compatible regular expression. - - - - FILTER_VALIDATE_URL - "validate_url" - - default - - - FILTER_FLAG_SCHEME_REQUIRED, - FILTER_FLAG_HOST_REQUIRED, - FILTER_FLAG_PATH_REQUIRED, - FILTER_FLAG_QUERY_REQUIRED, - FILTER_NULL_ON_FAILURE - - Validates value as URL (according to &url.rfc;2396), optionally with required components. Beware a valid URL may not specify the HTTP protocol http:// so further validation may be required to determine the URL uses an expected protocol, e.g. ssh:// or mailto:. Note that the function will only find ASCII URLs to be valid; internationalized domain names (containing non-ASCII characters) will fail. - - - -
- - - - When default is set to option, - default's value is used if value is not validated. - - - - - &reftitle.changelog; - - - - - - &Version; - &Description; - - - - - 8.0.0 - - The FILTER_FLAG_SCHEME_REQUIRED and - FILTER_FLAG_HOST_REQUIRED flags for the - FILTER_VALIDATE_URL filter have been removed. - The scheme and host are (and have been) always required. - - - - 8.0.0 - - Added FILTER_VALIDATE_BOOL as an alias for FILTER_VALIDATE_BOOLEAN. - Using FILTER_VALIDATE_BOOL is preferred. - - - - 7.4.0 - - Added min_range and max_range - options for FILTER_VALIDATE_FLOAT. - - - - 7.0.0 - - Added FILTER_FLAG_HOSTNAME and FILTER_VALIDATE_DOMAIN. - - - - - - - - -
- - +
Sanitize filters @@ -643,178 +388,6 @@ filter.default_flags = 0 Encodes ampersands (&). - - FILTER_NULL_ON_FAILURE - - any FILTER_VALIDATE_* - - - Returns &null; for unrecognized values. - - - - FILTER_FLAG_ALLOW_OCTAL - - FILTER_VALIDATE_INT - - - Regards inputs starting with a zero (0) as octal - numbers. This only allows the succeeding digits to be - 0-7. - - - - FILTER_FLAG_ALLOW_HEX - - FILTER_VALIDATE_INT - - - Regards inputs starting with 0x or - 0X as hexadecimal numbers. This only allows - succeeding characters to be a-fA-F0-9. - - - - FILTER_FLAG_EMAIL_UNICODE - - FILTER_VALIDATE_EMAIL - - - Allows the local part of the email address to contain Unicode characters. - - - - FILTER_FLAG_IPV4 - - FILTER_VALIDATE_IP - - - Allows the IP address to be in IPv4 format. - - - - FILTER_FLAG_IPV6 - - FILTER_VALIDATE_IP - - - Allows the IP address to be in IPv6 format. - - - - FILTER_FLAG_NO_PRIV_RANGE - - FILTER_VALIDATE_IP - - - - Fails validation for the following private IPv4 ranges: - 10.0.0.0/8, 172.16.0.0/12 and - 192.168.0.0/16. - - - Fails validation for the IPv6 addresses starting with - FD or FC. - - - - - FILTER_FLAG_NO_RES_RANGE - - FILTER_VALIDATE_IP - - - - Fails validation for the following reserved IPv4 ranges: - 0.0.0.0/8, 169.254.0.0/16, - 127.0.0.0/8 and 240.0.0.0/4. - - - Fails validation for the following reserved IPv6 ranges: - ::1/128, ::/128, - ::ffff:0:0/96 and fe80::/10. - - - These are the ranges that are marked as Reserved-By-Protocol in - RFC 6890. - - - - - FILTER_FLAG_GLOBAL_RANGE - - FILTER_VALIDATE_IP - - - - Fails validation for non global IPv4/IPv6 ranges as found in - RFC 6890 with the - Global attribute being False. - - - - - FILTER_FLAG_SCHEME_REQUIRED - - FILTER_VALIDATE_URL - - - Requires the URL to contain a scheme part. - - - - FILTER_FLAG_HOST_REQUIRED - - FILTER_VALIDATE_URL - - - Requires the URL to contain a host part. - - - - FILTER_FLAG_PATH_REQUIRED - - FILTER_VALIDATE_URL - - - Requires the URL to contain a path part. - - - - FILTER_FLAG_QUERY_REQUIRED - - FILTER_VALIDATE_URL - - - Requires the URL to contain a query string. - - - - FILTER_REQUIRE_SCALAR - - - - Requires the value to be scalar. - - - - FILTER_REQUIRE_ARRAY - - - - Requires the value to be an array. Filter given will be applied to each - scalar entry of the array. - - - - FILTER_FORCE_ARRAY - - - - If the value is a scalar, it is treated as array with the scalar value - as only element. - - From 9a85fe18baf7c56d65c7c53692ca297cee386115 Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 27 Oct 2024 19:43:02 +0000 Subject: [PATCH 07/11] Add IDN acronym --- reference/filter/constants.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index d3d183939b76..e1df2e916848 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -604,7 +604,7 @@ This filter only works on ASCII URLs. - This means that internationalized domain names will always be rejected. + This means that Internationalized Domain Names (IDN) will always be rejected. From 42fca6be4964b5830359cb2c2980b4b3472dbe6e Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 27 Oct 2024 21:09:40 +0000 Subject: [PATCH 08/11] Move some sanitization filters --- reference/filter/constants.xml | 125 +++++++++++++++++------------- reference/filter/filters.xml | 135 +-------------------------------- 2 files changed, 74 insertions(+), 186 deletions(-) diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index e1df2e916848..56d3221ae6ed 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -247,41 +247,6 @@ - - - - FILTER_FLAG_ALLOW_FRACTION - (int) - - - - Allow fractional part in "number_float" filter. - - - - - - FILTER_FLAG_ALLOW_THOUSAND - (int) - - - - Allow thousand separator (,) in "number_float" filter. - - - - - - FILTER_FLAG_ALLOW_SCIENTIFIC - (int) - - - - Allow scientific notation (e, E) in - "number_float" filter. - - - @@ -482,7 +447,8 @@ - + Accept commas (,) character, + which usually represents the thousand separator. @@ -852,7 +818,7 @@ - + Sanitizing Filters @@ -942,7 +908,11 @@ - ID of "email" filter. + Sanitize the string by remove all characters except + latin letters ([a-zA-Z]), + digits ([0-9]), + and the special characters + !#$%&'*+-=?^_`{|}~@.[]. @@ -953,7 +923,11 @@ - ID of "url" filter. + Sanitize the string by remove all characters except + latin letters ([a-zA-Z]), + digits ([0-9]), + and the special characters + $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=. @@ -964,7 +938,9 @@ - ID of "number_int" filter. + Sanitize the string by remove all characters except digits + ([0-9]), plus sign (+), + and minus sign (-). @@ -975,37 +951,82 @@ - ID of "number_float" filter. + Sanitize the string by remove all characters except digits + ([0-9]), plus sign (+), + and minus sign (-). + + + Optional Flags + + + FILTER_FLAG_ALLOW_FRACTION + (int) + + + + Accept dot (.) character, + which usually represents the separator between the integer and + fractional parts. + + + + + + FILTER_FLAG_ALLOW_THOUSAND + (int) + + + + Accept commas (,) character, + which usually represents the thousand separator. + + + + + + FILTER_FLAG_ALLOW_SCIENTIFIC + (int) + + + + Accept numbers in scientific notation by allowing the + e and E characters. + + + + - + + - FILTER_SANITIZE_MAGIC_QUOTES - (int) + FILTER_SANITIZE_ADD_SLASHES + (int) - ID of "magic_quotes" filter. - (DEPRECATED as of PHP 7.3.0 and - REMOVED as of PHP 8.0.0, - use FILTER_SANITIZE_ADD_SLASHES instead.) + Apply addslashes to the input. + Available as of PHP 7.3.0. - + + - FILTER_SANITIZE_ADD_SLASHES + FILTER_SANITIZE_MAGIC_QUOTES (int) - ID of "add_slashes" filter. - (Available as of PHP 7.3.0) + Alias of FILTER_SANITIZE_ADD_SLASHES. + (DEPRECATED as of PHP 7.3.0 and + REMOVED as of PHP 8.0.0) + User Defined Filter diff --git a/reference/filter/filters.xml b/reference/filter/filters.xml index 8b1e98fe21b0..970ccb6202fa 100644 --- a/reference/filter/filters.xml +++ b/reference/filter/filters.xml @@ -19,15 +19,6 @@ - - FILTER_SANITIZE_EMAIL - "email" - - - Remove all characters except letters, digits and - !#$%&'*+-=?^_`{|}~@.[]. - - FILTER_SANITIZE_ENCODED "encoded" @@ -40,44 +31,6 @@ URL-encode string, optionally strip or encode special characters. - - FILTER_SANITIZE_MAGIC_QUOTES - "magic_quotes" - - - Apply addslashes. - (DEPRECATED as of PHP 7.3.0 and - REMOVED as of PHP 8.0.0, - use FILTER_SANITIZE_ADD_SLASHES instead.) - - - - FILTER_SANITIZE_ADD_SLASHES - "add_slashes" - - Apply addslashes. (Available as of PHP 7.3.0) - - - FILTER_SANITIZE_NUMBER_FLOAT - "number_float" - - FILTER_FLAG_ALLOW_FRACTION, - FILTER_FLAG_ALLOW_THOUSAND, - FILTER_FLAG_ALLOW_SCIENTIFIC - - - Remove all characters except digits, +- and - optionally .,eE. - - - - FILTER_SANITIZE_NUMBER_INT - "number_int" - - - Remove all characters except digits, plus and minus sign. - - FILTER_SANITIZE_SPECIAL_CHARS "special_chars" @@ -127,25 +80,6 @@ use htmlspecialchars instead.) - - FILTER_SANITIZE_STRIPPED - "stripped" - - - Alias of "string" filter. - (Deprecated as of PHP 8.1.0, - use htmlspecialchars instead.) - - - - FILTER_SANITIZE_URL - "url" - - - Remove all characters except letters, digits and - $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=. - - FILTER_UNSAFE_RAW "unsafe_raw" @@ -166,24 +100,7 @@ - - - When using one of these filters as a default filter either through your ini file - or through your web server's configuration, the default flags is set to - FILTER_FLAG_NO_ENCODE_QUOTES. You need to explicitly set - filter.default_flags to 0 to have quotes encoded by default. Like this: - - Configuring the default filter to act like htmlspecialchars - - - - - - - + &reftitle.changelog; @@ -203,25 +120,6 @@ filter.default_flags = 0 FILTER_SANITIZE_STRIPPED have been deprecated. - - 8.0.0 - - FILTER_SANITIZE_MAGIC_QUOTES has been removed. - - - - 7.3.0 - - FILTER_SANITIZE_ADD_SLASHES was added as a - replacement for FILTER_SANITIZE_MAGIC_QUOTES - - - - 7.3.0 - - FILTER_SANITIZE_MAGIC_QUOTES has been deprecated. - - @@ -314,37 +212,6 @@ filter.default_flags = 0 Strips backtick characters. - - FILTER_FLAG_ALLOW_FRACTION - - FILTER_SANITIZE_NUMBER_FLOAT - - - Allows a period (.) as a fractional separator in - numbers. - - - - FILTER_FLAG_ALLOW_THOUSAND - - FILTER_SANITIZE_NUMBER_FLOAT, - FILTER_VALIDATE_FLOAT - - - Allows a comma (,) as a thousands separator in - numbers. - - - - FILTER_FLAG_ALLOW_SCIENTIFIC - - FILTER_SANITIZE_NUMBER_FLOAT - - - Allows an e or E for scientific - notation in numbers. - - FILTER_FLAG_NO_ENCODE_QUOTES From 1adb620be1a9bdb586941869d102ef3575d3adf9 Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 27 Oct 2024 22:44:44 +0000 Subject: [PATCH 09/11] Some nits --- reference/filter/constants.xml | 16 ++++++++++------ reference/filter/filters.xml | 2 +- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index 56d3221ae6ed..acbd231c40c3 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -93,8 +93,8 @@ - - Filter Flags + + Generic Filter Flags FILTER_FLAG_NONE @@ -150,13 +150,16 @@ Use &null; instead of &false; on failure. - Usable with any + Usable with any validation FILTER_VALIDATE_* filter. + + + Sanitization Filter Flags FILTER_FLAG_STRIP_LOW @@ -186,7 +189,7 @@ - Strips backtick characters. + Strips backtick (` characters. @@ -230,7 +233,8 @@ - Don't encode ' and ". + Singe and double quotes (' and ") + will not be encoded. @@ -241,7 +245,7 @@ - + If sanitizing a string results in an empty string, convert the value to &null; diff --git a/reference/filter/filters.xml b/reference/filter/filters.xml index 970ccb6202fa..f0324ba4ef88 100644 --- a/reference/filter/filters.xml +++ b/reference/filter/filters.xml @@ -2,7 +2,7 @@ Types of filters - +
Sanitize filters From 185c5c19392e4e095e8b38d71c27c8796b0a2a17 Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 3 Nov 2024 17:46:58 +0000 Subject: [PATCH 10/11] Wording Co-authored-by: Christoph M. Becker --- reference/filter/constants.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index acbd231c40c3..ef201715c711 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -451,8 +451,8 @@ - Accept commas (,) character, - which usually represents the thousand separator. + Accept commas (,), + which usually represent the thousand separator. From 0a1664a3cd901cec0c680e68c9f0888e1837f0da Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Sun, 3 Nov 2024 17:49:07 +0000 Subject: [PATCH 11/11] Whitespaces --- reference/filter/constants.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index ef201715c711..91e1402a3a82 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -321,7 +321,7 @@ Validates whether the value is an integer, on success it is converted to type int. - + String values are trimmed using trim