Очистка (нормализация)

    Пример #1 Нормализация и валидация e-mail адресов

    <?php
    $a     = 'joe@example.org';
    $b = 'bogus - at - example dot org';
    $c = '(bogus@example.org)';

    $sanitized_a = filter_var($a, FILTER_SANITIZE_EMAIL);
    if (    filter_var($sanitized_a, FILTER_VALIDATE_EMAIL)) {
    echo     "Нормализованный e-mail (a) является верным.\n";
    }

    $sanitized_b = filter_var($b, FILTER_SANITIZE_EMAIL);
    if (    filter_var($sanitized_b, FILTER_VALIDATE_EMAIL)) {
    echo     "Нормализованный e-mail (b) является верным.";
    } else {
    echo     "Нормализованный e-mail (b) является неверным.\n";
    }

    $sanitized_c = filter_var($c, FILTER_SANITIZE_EMAIL);
    if (    filter_var($sanitized_c, FILTER_VALIDATE_EMAIL)) {
    echo     "Нормализованный e-mail (c) является верным.\n";
    echo     "До нормализации: $c\n";
    echo     "После нормализации: $sanitized_c\n";
    }
    ?>

    Результат выполнения приведённого примера: 

    Нормализованный e-mail (a) является верным.
Нормализованный e-mail (b) является неверным.
Нормализованный e-mail (c) является верным.
До нормализации: (bogus@example.org)
После нормализации: bogus@example.org

    Пример #2 Настройка фильтра по умолчанию

    filter.default = full_special_chars
    filter.default_flags = 0

    Улучшение страницы

    Инструкция • Исправление • Сообщение об ошибке
    ＋Добавить

    Примечания пользователей 2 notes

    up
    10
    zeeshan dot karamat dot abbas at gmail dot com
    9 years ago
    If we omit using a filter then PHP by default puts a filter which is FILTER_DEFAULT which will use default filter. Now the question is what is a default filter. A default filter is unsafe_raw which will allow the unsafe raw data passed on to the server. This value is available in php.ini file. It is suggested that a developer should update this value inside php.ini file as under:
    filter.default = full_special_chars
    filter.default_flags = 0

    Whereas in php.ini file above values are by default, set as under:
    ;filter.default = unsafe_raw
    ;filter.default_flags =

    Above semicolons are commented out lines so surely one needs to remove those semicolons to apply the changes made. If we do not do above things then what will happen. In that case PHP will use default filter which would surely be FILTER_UNSAFE_RAW and one can see that unsafe raw data can then be passed onto server which can make the life a hacker easier.
    up
    1
    Chris
    9 years ago
    While it may seem to be good practice to set the defaults in php.ini you should not assume that the end users server has the same settings as your server. Because of this you should not presume that default filtering will work out of the box for the end user.

    You should ensure that all filters are declared at the site of use regardless of your own default settings. A move to a new host even for your own personal application may break due to different settings.
    ＋Добавить
    To Top