0, 'INPUT_GET' => 1, 'INPUT_COOKIE' => 2, 'INPUT_ENV' => 4, 'INPUT_SERVER' => 5, 'FILTER_FLAG_NONE' => 0, 'FILTER_REQUIRE_SCALAR' => 33554432, 'FILTER_REQUIRE_ARRAY' => 16777216, 'FILTER_FORCE_ARRAY' => 67108864, 'FILTER_NULL_ON_FAILURE' => 134217728, 'FILTER_VALIDATE_INT' => 257, 'FILTER_VALIDATE_BOOLEAN' => 258, 'FILTER_VALIDATE_FLOAT' => 259, 'FILTER_VALIDATE_REGEXP' => 272, 'FILTER_VALIDATE_URL' => 273, 'FILTER_VALIDATE_EMAIL' => 274, 'FILTER_VALIDATE_IP' => 275, 'FILTER_DEFAULT' => 516, 'FILTER_UNSAFE_RAW' => 516, 'FILTER_SANITIZE_STRING' => 513, 'FILTER_SANITIZE_STRIPPED' => 513, 'FILTER_SANITIZE_ENCODED' => 514, 'FILTER_SANITIZE_SPECIAL_CHARS' => 515, 'FILTER_SANITIZE_EMAIL' => 517, 'FILTER_SANITIZE_URL' => 518, 'FILTER_SANITIZE_NUMBER_INT' => 519, 'FILTER_SANITIZE_NUMBER_FLOAT' => 520, 'FILTER_SANITIZE_MAGIC_QUOTES' => 521, 'FILTER_CALLBACK' => 1024, 'FILTER_FLAG_ALLOW_OCTAL' => 1, 'FILTER_FLAG_ALLOW_HEX' => 2, 'FILTER_FLAG_STRIP_LOW' => 4, 'FILTER_FLAG_STRIP_HIGH' => 8, 'FILTER_FLAG_ENCODE_LOW' => 16, 'FILTER_FLAG_ENCODE_HIGH' => 32, 'FILTER_FLAG_ENCODE_AMP' => 64, 'FILTER_FLAG_NO_ENCODE_QUOTES' => 128, 'FILTER_FLAG_EMPTY_STRING_NULL' => 256, 'FILTER_FLAG_ALLOW_FRACTION' => 4096, 'FILTER_FLAG_ALLOW_THOUSAND' => 8192, 'FILTER_FLAG_ALLOW_SCIENTIFIC' => 16384, 'FILTER_FLAG_SCHEME_REQUIRED' => 65536, 'FILTER_FLAG_HOST_REQUIRED' => 131072, 'FILTER_FLAG_PATH_REQUIRED' => 262144, 'FILTER_FLAG_QUERY_REQUIRED' => 524288, 'FILTER_FLAG_IPV4' => 1048576, 'FILTER_FLAG_IPV6' => 2097152, 'FILTER_FLAG_NO_RES_RANGE' => 4194304, 'FILTER_FLAG_NO_PRIV_RANGE' => 8388608, ); foreach ($constants as $constant => $value) if (!defined($constant)) define($constant, $value); } function filter_var ($variable, $filter = FILTER_SANITIZE_STRING, $user_options = false) { // Setup a default filter. $filter = $filter === false ? FILTER_SANITIZE_STRING : $filter; // Maybe we have some flags/options. if (!empty($user_options) { $options = !empty($user_options['options']) ? &$user_options['options'] : null; $flags = !empty($user_options['flags']) ? &$user_options['flags'] : null;; } switch ($filter) { // Validates value as integer, optionally from the specified range. case FILTER_VALIDATE_INT: $filter_flags = array(FILTER_FLAG_ALLOW_OCTAL, FILTER_FLAG_ALLOW_HEX); $filter_options = array('min_range', 'max_range'); if (isset($options['max_range'])) $variable = min($options['max_range'], $variable); if (isset($options['min_range'])) $variable = max($options['min_range'], $variable); break; // Returns TRUE for "1", "true", "on" and "yes", FALSE for "0", "false", "off", "no", and "", NULL otherwise. case FILTER_VALIDATE_BOOLEAN: if (in_array($variable, array(1, true, 'on', 'yes'))) $variable = true; elseif (in_array($variable, array(0, false, 'off', 'no', ''))) $variable = false; else $variable = null; break; // Validates value as float. case FILTER_VALIDATE_FLOAT: $variable = is_float($variable); break; // Validates value against regexp, a Perl-compatible regular expression. case FILTER_VALIDATE_REGEXP: $filter_options = array('regexp'); // !!! Not implemented yet. break; // Validates value as URL, optionally with required components. case FILTER_VALIDATE_URL: $filter_flags = array(FILTER_FLAG_SCHEME_REQUIRED, FILTER_FLAG_HOST_REQUIRED, FILTER_FLAG_PATH_REQUIRED, FILTER_FLAG_QUERY_REQUIRED); break; // Validates value as IP address, optionally only IPv4 or IPv6 or not from private or reserved ranges. case FILTER_VALIDATE_IP: $filter_flags = array(FILTER_FLAG_IPV4, FILTER_FLAG_IPV6, FILTER_FLAG_NO_PRIV_RANGE, FILTER_FLAG_NO_RES_RANGE); break; // Strip tags, optionally strip or encode special characters. case FILTER_SANITIZE_STRING: $filter_flags = array(FILTER_FLAG_NO_ENCODE_QUOTES, FILTER_FLAG_STRIP_LOW, FILTER_FLAG_STRIP_HIGH, FILTER_FLAG_ENCODE_LOW, FILTER_FLAG_ENCODE_HIGH, FILTER_FLAG_ENCODE_AMP); break; // Alias of "string" filter. case FILTER_SANITIZE_STRIPPED: break; // URL-encode string, optionally strip or encode special characters. case FILTER_SANITIZE_ENCODED: $filter_flags = array(FILTER_FLAG_STRIP_LOW, FILTER_FLAG_STRIP_HIGH, FILTER_FLAG_ENCODE_LOW, FILTER_FLAG_ENCODE_HIGH); break; // HTML-escape '"<>& and characters with ASCII value less than 32, optionally strip or encode other special characters. case FILTER_SANITIZE_SPECIAL_CHARS: $filter_flags = array(FILTER_FLAG_STRIP_LOW, FILTER_FLAG_STRIP_HIGH, FILTER_FLAG_ENCODE_HIGH); break; // Do nothing, optionally strip or encode special characters. case FILTER_UNSAFE_RAW: $filter_flags = array(FILTER_FLAG_STRIP_LOW, FILTER_FLAG_STRIP_HIGH, FILTER_FLAG_ENCODE_LOW, FILTER_FLAG_ENCODE_HIGH, FILTER_FLAG_ENCODE_AMP); break; // Remove all characters except letters, digits and !#$%&'*+-/=?^_`{|}~@.[]. case FILTER_SANITIZE_EMAIL: // Validates value as e-mail. case FILTER_VALIDATE_EMAIL: // Break this up in to a domain and a user $email = explode('@', $variable); // There has to be two parts to an email. if (count($email) != 2) { $variable = null; break; } // Remove the bad stuff from this email. if ($filter == FILTER_SANITIZE_EMAIL) $email = preg_replace('/[^a-zA-Z0-9!#$%&\\\'*+\\-\/=?^_`{|}~.\\[\\]]+/', '', $email); // Emails can't be larger than {64}@{255} if (count($email[0]) > 64 || count($email[0]) < 1 || count($email[1]) > 255 || count($email[1]) < 4) { $variable = null; break; } $variable = implode('@', $email); break; // Remove all characters except letters, digits and $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=. case FILTER_SANITIZE_URL: // Maybe it is supposed to be [^a-zA-Z0-9\\$-_\\.\\+\\!\\*\'\\(\\),\\{\\}\\|\\\\\\^~\\[\\]`\\<\\>#%\";/\\?\\:@&\\=]+ $variable = preg_replace('/[^a-zA-Z0-9$\\-_.+!*\'(),{}|\\\\^~\\[\\]`<>#%";\/?:@&=]+/', '', $variable); $ break; // Remove all characters except digits and +-. case FILTER_SANITIZE_NUMBER_INT: $variable = preg_replace('/[^\d+\-]+/', '', $variable); break; // Remove all characters except digits, +- and optionally .,eE. case FILTER_SANITIZE_NUMBER_FLOAT: $filter_flags = array(FILTER_FLAG_ALLOW_FRACTION, FILTER_FLAG_ALLOW_THOUSAND, FILTER_FLAG_ALLOW_SCIENTIFIC); $variable = preg_replace('/[^\d+\-\.,eE]+/', '', $variable); break; // Apply addslashes(). case FILTER_SANITIZE_MAGIC_QUOTES: $variable = addslashes($variable); break; // Call user-defined function to filter data. case FILTER_CALLBACK: $variable = call_user_func($variable); break; } return $variable; } ?>