Class Sanitize

cleansource public static

clean( string|array $data , string|array $options array() )

Sanitizes given array or value for safe input. Use the options to specify the connection to use, and what filters should be applied (with a boolean value). Valid filters:

• odd_spaces - removes any non space whitespace characters
• encode - Encode any html entities. Encode must be true for the remove_html to work.
• dollar - Escape $ with \$
• carriage - Remove \r
• unicode -
• escape - Should the string be SQL escaped.
• backslash -
• remove_html - Strip HTML with strip_tags. encode must be true for this option to work.

Parameters

string|array $data

Data to sanitize

string|array $options optional array()

If string, DB connection being used, otherwise set of options

Returns

mixed
Sanitized data

escapesource public static

escape( string $string , string $connection 'default' )

Makes a string SQL-safe.

Parameters

string $string

String to sanitize

string $connection optional 'default'

Database connection being used

Returns

string
SQL safe string

htmlsource public static

html( string $string , array $options array() )

Returns given string safe for display as HTML. Renders entities.

strip_tags() does not validating HTML syntax or structure, so it might strip whole passages with broken HTML.

Options:

• remove (boolean) if true strips all HTML tags before encoding
• charset (string) the charset used to encode the string
• quotes (int) see http://php.net/manual/en/function.htmlentities.php
• double (boolean) double encode html entities

Parameters

string $string

String from where to strip tags

array $options optional array()

Array of options to use.

Returns

string
Sanitized string

paranoidsource public static

paranoid( string $string , array $allowed array() )

Removes any non-alphanumeric characters.

Parameters

string $string

String to sanitize

array $allowed optional array()

An array of additional characters that are not to be removed.

Returns

string
Sanitized string

stripAllsource public static

stripAll( string $str )

Strips extra whitespace, images, scripts and stylesheets from output

Parameters

string $str

String to sanitize

Returns

string
sanitized string

stripImagessource public static

stripImages( string $str )

Strips image tags from output

Parameters

string $str

String to sanitize

Returns

string
Sting with images stripped.

stripScriptssource public static

stripScripts( string $str )

Strips scripts and stylesheets from output

Parameters

string $str

String to sanitize

Returns

string
String with <link>, <img>, <script>, <style> elements and html comments removed.

stripTagssource public static

stripTags( string $str )

Strips the specified tags from output. First parameter is string from where to remove tags. All subsequent parameters are tags.

Ex.$clean = Sanitize::stripTags($dirty, 'b', 'p', 'div');

Will remove all <b>, <p>, and <div> tags from the $dirty string.

Parameters

string $str

String to sanitize.

Returns

string
sanitized String

stripWhitespacesource public static

stripWhitespace( string $str )

Strips extra whitespace from output

Parameters

string $str

String to sanitize

Returns

string
whitespace sanitized string