Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deprecation of FILTER_SANITIZE_STRING #30

Open
SpottedPaint opened this issue Jun 7, 2023 · 1 comment
Open

Deprecation of FILTER_SANITIZE_STRING #30

SpottedPaint opened this issue Jun 7, 2023 · 1 comment

Comments

@SpottedPaint
Copy link

In PHP 8.1 FILTER_SANITIZE_STRING seems to be deprecated.
They suggest swapping for htmlspecialchars but that doesn't seem to be an exact swap.
https://www.php.net/manual/en/filter.filters.sanitize.php

I've swapped line 106 in my installations login-nocaptcha.php
from
return trim(filter_var($string, FILTER_SANITIZE_STRING)); //must consist of valid string characters
to
return trim(htmlspecialchars(strip_tags($string), ENT_QUOTES, null, false));

There is a discussion on stack overflow here https://stackoverflow.com/questions/69207368/constant-filter-sanitize-string-is-deprecated

My messy testing file is which shows some of the differences, FILTER_SANITIZE_FULL_SPECIAL_CHARS seems to act quite differently with tags:
`
$strings = array();
$strings[] =" Start Tags: SingleQuote:'".' Tag With Attribute:<span="classname"> Encoded Less Than:< End';
$strings[] ='Start DoubleQuote:" End ';
$strings[] ='Start 中文 End ';
foreach($strings as $string){

	$specialChars = trim(htmlspecialchars(strip_tags($string), ENT_QUOTES, null, false));
	echo PHP_EOL;
	$filtered =  trim(@filter_var($string, FILTER_SANITIZE_STRING));
	$filteredAlternative = trim(filter_var($string, FILTER_SANITIZE_FULL_SPECIAL_CHARS));
	
	echo PHP_EOL;
	echo 'S:'.$specialChars.PHP_EOL;
	echo 'F:'.$filtered.PHP_EOL;
	echo 'A:'.$filteredAlternative.PHP_EOL;
}

`

@cyberscribe
Copy link
Owner

Thanks we would welcome a pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants