<?php/******************************************************************************* Created by Joshua Dickerson (groundup) (April, 2007)* PHP < 5.2 Filters** A port of the PHP filters for those that want to have the functions of the* PHP filters without upgrading or installing it via PECL.** See http://www.php.net/filter for more information about PHP filters.******************************************************************************//* USAGE: * Include this file in your script. * Call define_filter_constants(). * Call the functions the same as is documented on the PHP website. NOTES: * I've included a lot of comments because the PHP site's documentation is lacking to say the least. * Anywhere you see *** that means that it is specific to this script. * There may be some extra functionality in this script which isn't available in the PHP version. If you plan on using it with the PHP version or distributing it, change the function names. FUNCTION REFERENCE: mixed define_filter_constants (return = false) *** - Defines constants used in this script. - Returns $constants if $return = true. - Returns null otherwise. filter_has_var - filter_id - filter_input_array - filter_input - filter_list - filter_var_array - filter_var -*/// Define a LOT of constantsfunction define_filter_constants($return = false){ $flags = array( // 'FILTER_FLAG_NONE' => 0, // Allow octal notation (0[0-7]+) in "int" filter. 'FILTER_FLAG_ALLOW_OCTAL' => 1, // Allow hex notation (0x[0-9a-fA-F]+) in "int" filter. 'FILTER_FLAG_ALLOW_HEX' => 2, // Strip characters with ASCII value less than 32. 'FILTER_FLAG_STRIP_LOW' => 4, // Strip characters with ASCII value greater than 127. 'FILTER_FLAG_STRIP_HIGH' => 8, // Encode characters with ASCII value less than 32. 'FILTER_FLAG_ENCODE_LOW' => 16, // Encode characters with ASCII value greater than 127. 'FILTER_FLAG_ENCODE_HIGH' => 32, // Encode &. 'FILTER_FLAG_ENCODE_AMP' => 64, // Don't encode ' and ". 'FILTER_FLAG_NO_ENCODE_QUOTES' => 128, // (No use for now.) 'FILTER_FLAG_EMPTY_STRING_NULL' => 256, // Allow fractional part in "number_float" filter. 'FILTER_FLAG_ALLOW_FRACTION' => 4096, // Allow thousand separator (,) in "number_float" filter. 'FILTER_FLAG_ALLOW_THOUSAND' => 8192, // Allow scientific notation (e, E) in "number_float" filter. 'FILTER_FLAG_ALLOW_SCIENTIFIC' => 16384, // Require scheme in "validate_url" filter. 'FILTER_FLAG_SCHEME_REQUIRED' => 65536, // Require host in "validate_url" filter. 'FILTER_FLAG_HOST_REQUIRED' => 131072, // Require path in "validate_url" filter. 'FILTER_FLAG_PATH_REQUIRED' => 262144, // Require query in "validate_url" filter. 'FILTER_FLAG_QUERY_REQUIRED' => 524288, // Allow only IPv4 address in "validate_ip" filter. 'FILTER_FLAG_IPV4' => 1048576, // Allow only IPv6 address in "validate_ip" filter. 'FILTER_FLAG_IPV6' => 2097152, // Deny reserved addresses in "validate_ip" filter. 'FILTER_FLAG_NO_RES_RANGE' => 4194304, // Deny private addresses in "validate_ip" filter. 'FILTER_FLAG_NO_PRIV_RANGE' => 8388608, ); if ($return == 'flags') return $flags; $filters = array( 'INPUT_POST' => 0, 'INPUT_GET' => 1, 'INPUT_COOKIE' => 2, 'INPUT_ENV' => 4, 'INPUT_SERVER' => 5, 'FILTER_REQUIRE_SCALAR' => 33554432, 'FILTER_REQUIRE_ARRAY' => 16777216, 'FILTER_FORCE_ARRAY' => 67108864, 'FILTER_NULL_ON_FAILURE' => 134217728, 'FILTER_VALIDATE_INT' => 257, 'FILTER_VALIDATE_BOOLEAN' => 258, 'FILTER_VALIDATE_FLOAT' => 259, 'FILTER_VALIDATE_REGEXP' => 272, 'FILTER_VALIDATE_URL' => 273, 'FILTER_VALIDATE_EMAIL' => 274, 'FILTER_VALIDATE_IP' => 275, 'FILTER_DEFAULT' => 516, 'FILTER_UNSAFE_RAW' => 516, 'FILTER_SANITIZE_STRING' => 513, 'FILTER_SANITIZE_STRIPPED' => 513, 'FILTER_SANITIZE_ENCODED' => 514, 'FILTER_SANITIZE_SPECIAL_CHARS' => 515, 'FILTER_SANITIZE_EMAIL' => 517, 'FILTER_SANITIZE_URL' => 518, 'FILTER_SANITIZE_NUMBER_INT' => 519, 'FILTER_SANITIZE_NUMBER_FLOAT' => 520, 'FILTER_SANITIZE_MAGIC_QUOTES' => 521, 'FILTER_CALLBACK' => 1024, // *** These constants are specific to this script. 'FILTER_SANITIZE_INT' => -9000; ); if ($return == 'filters') return $filters; $constants = array_merge($filters, $flags); if ($return !== false) return $constants; foreach ($constants as $constant => $value) if (!defined($constant)) define($constant, $value);}function filter_var ($variable, $filter = FILTER_SANITIZE_STRING, $user_options = false){ // Setup a default filter. $filter = $filter === false ? FILTER_SANITIZE_STRING : $filter; // Maybe we have some flags/options. if (is_array($user_options)) { $options = !empty($user_options['options']) ? array($user_options['options']) : null; $flags = !empty($user_options['flags']) ? array($user_options['flags']) : null;; } else { $flags = array($user_options); $options = array(); } /* They passed a constant. else { $constants = define_filter_constants('flags'); if ($constants } */ switch ($filter) { // Validates value as integer, optionally from the specified range. case FILTER_VALIDATE_INT: // *** Specific to this script. case FILTER_SANITIZE_INT: $filter_flags = array(FILTER_FLAG_ALLOW_OCTAL, FILTER_FLAG_ALLOW_HEX); $filter_options = array('min_range', 'max_range'); if (!is_int($variable)) { $variable = false; break; } if (isset($options['max_range'])) $variable = $filter == FILTER_SANITIZE_INT && min($options['max_range'], $variable) == $variable ? $variable : min($options['max_range'], $variable); if (isset($options['min_range'])) $variable = $filter == FILTER_SANITIZE_INT && max($options['min_range'], $variable) == $variable ? $variable : max($options['min_range'], $variable); break; // Returns TRUE for "1", "true", "on" and "yes", FALSE for "0", "false", "off", "no", and "", NULL otherwise. case FILTER_VALIDATE_BOOLEAN: if (in_array($variable, array(1, true, 'on', 'yes'))) $variable = true; elseif (in_array($variable, array(0, false, 'off', 'no', ''))) $variable = false; else $variable = null; break; // Validates value as float. case FILTER_VALIDATE_FLOAT: $variable = is_float($variable); break; // Validates value against regexp, a Perl-compatible regular expression. case FILTER_VALIDATE_REGEXP: $filter_options = array('regexp'); // !!! Not implemented yet. break; // Validates value as URL, optionally with required components. case FILTER_VALIDATE_URL: $filter_flags = array(FILTER_FLAG_SCHEME_REQUIRED, FILTER_FLAG_HOST_REQUIRED, FILTER_FLAG_PATH_REQUIRED, FILTER_FLAG_QUERY_REQUIRED); break; // Validates value as IP address, optionally only IPv4 or IPv6 or not from private or reserved ranges. case FILTER_VALIDATE_IP: $filter_flags = array(FILTER_FLAG_IPV4, FILTER_FLAG_IPV6, FILTER_FLAG_NO_PRIV_RANGE, FILTER_FLAG_NO_RES_RANGE); break; // Strip tags, optionally strip or encode special characters. case FILTER_SANITIZE_STRING: // Alias of "string" filter. case FILTER_SANITIZE_STRIPPED: $filter_flags = array(FILTER_FLAG_NO_ENCODE_QUOTES, FILTER_FLAG_STRIP_LOW, FILTER_FLAG_STRIP_HIGH, FILTER_FLAG_ENCODE_LOW, FILTER_FLAG_ENCODE_HIGH, FILTER_FLAG_ENCODE_AMP); $swap = array(); if (in_array(FILTER_FLAG_ENCODE_AMP, $flags)) $swap['&'] => '&'; if (in_array(FILTER_FLAG_STRIP_LOW, $flags)) $variable = preg_replace('/[\0-\32]+/', '', $variable); if (in_array(FILTER_FLAG_STRIP_HIGH, $flags)) $variable = preg_replace('/[^\0-\32]+/', '', $variable); break; // URL-encode string, optionally strip or encode special characters. case FILTER_SANITIZE_ENCODED: $filter_flags = array(FILTER_FLAG_STRIP_LOW, FILTER_FLAG_STRIP_HIGH, FILTER_FLAG_ENCODE_LOW, FILTER_FLAG_ENCODE_HIGH); break; // HTML-escape '"<>& and characters with ASCII value less than 32, optionally strip or encode other special characters. case FILTER_SANITIZE_SPECIAL_CHARS: $filter_flags = array(FILTER_FLAG_STRIP_LOW, FILTER_FLAG_STRIP_HIGH, FILTER_FLAG_ENCODE_HIGH); break; // Do nothing, optionally strip or encode special characters. case FILTER_UNSAFE_RAW: $filter_flags = array(FILTER_FLAG_STRIP_LOW, FILTER_FLAG_STRIP_HIGH, FILTER_FLAG_ENCODE_LOW, FILTER_FLAG_ENCODE_HIGH, FILTER_FLAG_ENCODE_AMP); break; // Remove all characters except letters, digits and !#$%&'*+-/=?^_`{|}~@.[]. case FILTER_SANITIZE_EMAIL: // Validates value as e-mail. case FILTER_VALIDATE_EMAIL: // Break this up in to a domain and a user $email = explode('@', $variable); // There has to be two parts to an email. if (count($email) != 2) { $variable = null; break; } // Remove the bad stuff from this email. if ($filter == FILTER_SANITIZE_EMAIL) $email = preg_replace('/[^a-zA-Z0-9!#$%&\\\'*+\\-\/=?^_`{|}~.\\[\\]]+/', '', $email); // Emails can't be larger than {64}@{255} if (count($email[0]) > 64 || count($email[0]) < 1 || count($email[1]) > 255 || count($email[1]) < 4) { $variable = null; break; } $variable = implode('@', $email); break; // Remove all characters except letters, digits and $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=. case FILTER_SANITIZE_URL: // Maybe it is supposed to be [^a-zA-Z0-9\\$-_\\.\\+\\!\\*\'\\(\\),\\{\\}\\|\\\\\\^~\\[\\]`\\<\\>#%\";/\\?\\:@&\\=]+ $variable = preg_replace('/[^a-zA-Z0-9$\\-_.+!*\'(),{}|\\\\^~\\[\\]`<>#%";\/?:@&=]+/', '', $variable); break; // Remove all characters except digits and +-. case FILTER_SANITIZE_NUMBER_INT: $variable = preg_replace('/[^\d\+\-]+/', '', $variable); //$variable = $variable == (int) $variable ? $variable : false; break; // Remove all characters except digits, +- and optionally .,eE. case FILTER_SANITIZE_NUMBER_FLOAT: $filter_flags = array(FILTER_FLAG_ALLOW_FRACTION, FILTER_FLAG_ALLOW_THOUSAND, FILTER_FLAG_ALLOW_SCIENTIFIC); $scientific = isset($flags[FILTER_FLAG_ALLOW_SCIENTIFIC]) ? '+eE' : ''; $variable = preg_replace('/[^\d\-\.,' . $scientific .']+/', '', $variable); break; // Apply addslashes(). case FILTER_SANITIZE_MAGIC_QUOTES: $variable = addslashes($variable); break; // Call user-defined function to filter data. case FILTER_CALLBACK: $variable = call_user_func($options[0], $variable); break; } return $variable;}?>