PHP过滤器之审查过滤器(Sanitize filters)

Myth丶恋晨 2022-06-02 03:22 229阅读 0赞

今天我们继续谈一谈PHP的过滤器的审查过滤器部分

![20180102114358395][]

![20180102114435211][]

警告:当使用这些过滤器可以通过ini文件或者通过您的Web服务器的配置,一个默认的过滤器的警告，默认标志设置为filter\_flag\_no\_encode\_quotes。为了使引用被编码你需要明确地设置filter.default\_flags为0。如：

filter.default = full\_special\_chars  
filter.default\_flags = 0

更新日志

<table style="border-collapse:collapse; border-spacing:0px; margin:0px 0px 1.5rem; width:1027px; border-color:rgb(204,204,204); color:rgb(51,51,51); font-family:&quot;Fira Sans&quot;,&quot;Source Sans Pro&quot;,Helvetica,Arial,sans-serif; font-size:16px; background-color:rgb(242,242,242)"> 
 <thead> 
  <tr style="border-width:1px; border-style:solid; border-color:rgb(196,201,223) rgb(196,201,223) rgb(136,146,191)"> 
   <th style="text-align:left; padding:0.25rem 0.5rem; background-color:rgb(196,201,223)"> 版本</th> 
   <th style="text-align:left; padding:0.25rem 0.5rem; background-color:rgb(196,201,223)"> 说明</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr style="border:1px solid rgb(204,204,204); background-color:rgb(255,255,255)"> 
   <td style="vertical-align:top; padding:0.25rem 0.5rem"><span style="font-size:14px">5.2.11/5.3.1</span></td> 
   <td style="vertical-align:top; padding:0.25rem 0.5rem"><span style="font-size:14px">斜线已经被<span style=""><span style="font-family:Fira Mono,Source Code Pro,monospace"><span style="line-height:1.5rem">FILTER_SANITIZE_EMAIL移除</span></span></span>. 保留之前的。</span></td> 
  </tr> 
 </tbody> 
</table>

接下来，我们对上面的过滤器一一解释下：

<?php
        header('content-type:text/html;charset=utf-8;');
        echo "----------------------FILTER_SANITIZE_EMAIL的使用--------------------------------------------------------<br>";
        // 可以清理除了 字母和数字 以及  !#$%&'*+-/=?^_`{|}~@.[] 以外的字符,
        // 经过测试，发现实用性不大，并不能很好的审查邮箱
        $var1 = "Hello,这是一个email地址sensus@sensus.com";//输出值为Helloemailsensus@sensus.com
        $var2 = "1";
        $var3 = 1;
        $var4 = true;
        $var5 = "&'*+-/=?^_`{|}~@.";
    
        echo $var1."的输出结果：";var_dump(filter_var($var1, FILTER_SANITIZE_EMAIL));
        echo $var2."的输出结果：";var_dump(filter_var($var2, FILTER_SANITIZE_EMAIL));
        echo $var3."的输出结果：";var_dump(filter_var($var3, FILTER_SANITIZE_EMAIL));
        echo $var4."的输出结果：";var_dump(filter_var($var4, FILTER_SANITIZE_EMAIL));
        echo $var5."的输出结果：";var_dump(filter_var($var5, FILTER_SANITIZE_EMAIL));
    
        echo "----------------------FILTER_SANITIZE_ENCODED的使用--------------------------------------------------------<br>";
    
        $var6 = "568158961@qq.com";
        $var7 = "568158961qq.com";
        $var8 = "http://fanyi.baidu.com/?aldtype=16047#en/zh/Slashes";
        echo $var6."的输出结果：";var_dump(filter_var($var6, FILTER_SANITIZE_ENCODED));
        echo $var7."的输出结果：";var_dump(filter_var($var7, FILTER_SANITIZE_ENCODED));
        echo $var8."的输出结果：";var_dump(filter_var($var8, FILTER_SANITIZE_ENCODED));
    
        echo "----------------------FILTER_SANITIZE_MAGIC_QUOTES的使用--------------------------------------------------------<br>";
        //FILTER_SANITIZE_MAGIC_QUOTES 过滤器对字符串执行 addslashes() 函数。该过滤器在预定义的字符串前面设置反斜杠。预定义字符是：单引号(') 双引号 (") 反斜线 (\) NULL
        $var9 = "'Hello PHP'";
        $var10 = "Peter's here!\NJHH";
        $var11 = "NULL";
        $var12 = " ";
        $var13 = true;
        $var14 = false;
        echo $var9."的输出结果：";var_dump(filter_var($var9, FILTER_SANITIZE_MAGIC_QUOTES));
        echo $var10."的输出结果：";var_dump(filter_var($var10, FILTER_SANITIZE_MAGIC_QUOTES));
        echo $var11."的输出结果：";var_dump(filter_var($var11, FILTER_SANITIZE_MAGIC_QUOTES));
        echo $var12."的输出结果：";var_dump(filter_var($var12, FILTER_SANITIZE_MAGIC_QUOTES));
        echo $var13."的输出结果：";var_dump(filter_var($var13, FILTER_SANITIZE_MAGIC_QUOTES));
        echo $var14."的输出结果：";var_dump(filter_var($var14, FILTER_SANITIZE_MAGIC_QUOTES));
    
        echo "----------------------FILTER_SANITIZE_NUMBER_FLOAT的使用--------------------------------------------------------<br>";
        //FILTER_FLAG_ALLOW_FRACTION - 允许小数分隔符 （比如 .） FILTER_FLAG_ALLOW_THOUSAND - 允许千位分隔符（比如 ,） FILTER_FLAG_ALLOW_SCIENTIFIC - 允许科学记数法（比如 e 和 E）
        $var28 = "5-2f+3.3pp";
        $var29 = "100.10";
        $var30 = "111,112,33";
        $var31 = "1e1";
        $var32 = true;
        $var33 = false;
        $var34 = 0;
        echo $var28."的输出结果：";var_dump(filter_var($var28, FILTER_SANITIZE_NUMBER_FLOAT));
        echo $var29."的输出结果：";var_dump(filter_var($var29, FILTER_SANITIZE_NUMBER_FLOAT,FILTER_FLAG_ALLOW_FRACTION));
        echo $var30."的输出结果：";var_dump(filter_var($var30, FILTER_SANITIZE_NUMBER_FLOAT,FILTER_FLAG_ALLOW_THOUSAND));
        echo $var31."的输出结果：";var_dump(filter_var($var31, FILTER_SANITIZE_NUMBER_FLOAT,FILTER_FLAG_ALLOW_SCIENTIFIC));
        echo $var32."的输出结果：";var_dump(filter_var($var32, FILTER_SANITIZE_NUMBER_FLOAT));
        echo $var33."的输出结果：";var_dump(filter_var($var33, FILTER_SANITIZE_NUMBER_FLOAT));
        echo $var34."的输出结果：";var_dump(filter_var($var34, FILTER_SANITIZE_NUMBER_FLOAT));
    
        echo "----------------------FILTER_SANITIZE_NUMBER_INT的使用--------------------------------------------------------<br>";
        // FILTER_SANITIZE_NUMBER_INT 过滤整数以外的字符
        $var35 = "192.168.100.185";
        $var36 = 0;
        $var37 = "a";
        $var38 = "……&*%65.54……￥";
        $var39 = true;
        echo $var35."的输出结果：";var_dump(filter_var($var35, FILTER_SANITIZE_NUMBER_INT));
        echo $var36."的输出结果：";var_dump(filter_var($var36, FILTER_SANITIZE_NUMBER_INT));
        echo $var37."的输出结果：";var_dump(filter_var($var37, FILTER_SANITIZE_NUMBER_INT));
        echo $var38."的输出结果：";var_dump(filter_var($var38, FILTER_SANITIZE_NUMBER_INT));
        echo $var39."的输出结果：";var_dump(filter_var($var39, FILTER_SANITIZE_NUMBER_INT));
    
        echo "----------------------FILTER_SANITIZE_SPECIAL_CHARS的使用--------------------------------------------------------<br>";
        $var35 = "192.168.100.185";
        $var36 = "70-33-D2-33-17-7D";
        $var37 = "2001:0:2a7b:7ded:185b:3573:3f57:9b8d";
        $var38 = "<span>q\n\rq</span>";
        $var39 = true;
        echo $var35."的输出结果：";var_dump(filter_var($var35, FILTER_SANITIZE_SPECIAL_CHARS));
        echo $var36."的输出结果：";var_dump(filter_var($var36, FILTER_SANITIZE_SPECIAL_CHARS));
        echo $var37."的输出结果：";var_dump(filter_var($var37, FILTER_SANITIZE_SPECIAL_CHARS));
        echo $var38."的输出结果：";var_dump(filter_var($var38, FILTER_SANITIZE_SPECIAL_CHARS));
        echo $var39."的输出结果：";var_dump(filter_var($var39, FILTER_SANITIZE_SPECIAL_CHARS));
    
        echo "----------------------FILTER_SANITIZE_FULL_SPECIAL_CHARS的使用--------------------------------------------------------<br>";
        // 该过滤器在PHP5.3.3被添加了
        $var40 = "2222";
        $var41 = "PHP";
        $var42 = "2001:0:2a7b:7ded:185b:3573:3f57:9b8d";
        $var43 = " ";
        $var44 = "<span>DIV\'\DIV</span>";
        echo $var40."的输出结果：";var_dump(filter_var($var40, FILTER_SANITIZE_FULL_SPECIAL_CHARS));
        echo $var41."的输出结果：";var_dump(filter_var($var41, FILTER_SANITIZE_FULL_SPECIAL_CHARS));
        echo $var42."的输出结果：";var_dump(filter_var($var42, FILTER_SANITIZE_FULL_SPECIAL_CHARS));
        echo $var43."的输出结果：";var_dump(filter_var($var43, FILTER_SANITIZE_FULL_SPECIAL_CHARS));
        echo $var44."的输出结果：";var_dump(filter_var($var44, FILTER_SANITIZE_FULL_SPECIAL_CHARS));
    
        echo "----------------------FILTER_SANITIZE_STRING的使用--------------------------------------------------------<br>";
        // FILTER_FLAG_NO_ENCODE_QUOTES - 该标志不编码引号
        // FILTER_FLAG_STRIP_LOW - 去除 ASCII 值在 32 以下的字符
        // FILTER_FLAG_STRIP_HIGH - 去除 ASCII 值在 32 以上的字符
        // FILTER_FLAG_ENCODE_LOW - 编码 ASCII 值在 32 以下的字符
        // FILTER_FLAG_ENCODE_HIGH - 编码 ASCII 值在 32 以上的字符
        // FILTER_FLAG_ENCODE_AMP - 把 & 字符编码为 &
        $var45 = "www.baidu.com
        ";//注意有回车键符，其ASCII码为13
        $var46 = "<a href='http://php.net/manual/zh/filter.filters.validate.php'>http://php.net/manual/zh/filter.filters.validate.php</a>";
        $var47 = "http://php.net/manual/zh/filter.filters.validate.php";
        $var48 = "PHP&GO";
        $var49 = 'She say:"I love PHP"';
        echo $var45."的输出结果：";var_dump(filter_var($var45, FILTER_SANITIZE_STRING,FILTER_FLAG_ENCODE_LOW));
        echo $var46."的输出结果：";var_dump(filter_var($var46, FILTER_SANITIZE_STRING));
        echo $var47."的输出结果：";var_dump(filter_var($var47, FILTER_SANITIZE_STRING));
        echo $var48."的输出结果：";var_dump(filter_var($var48, FILTER_SANITIZE_STRING,FILTER_FLAG_ENCODE_AMP));
        echo $var49."的输出结果：";var_dump(filter_var($var49, FILTER_SANITIZE_STRING,FILTER_FLAG_NO_ENCODE_QUOTES));
    
        echo "----------------------FILTER_SANITIZE_STRIPPED的使用--------------------------------------------------------<br>";
        //该过滤器是 FILTER_SANITIZE_STRING过滤器的别名。
        $var50 = "<a href='http://php.net/manual/zh/filter.filters.validate.php'>http://php.net/manual/zh/filter.filters.validate.php</a>";
        $var51 = "http://php.net/manual/zh/filter.filters.validate.php";
        $var52 = "PHP&GO";
        $var53 = 'She say:"I love PHP"';
        $var54 = 'She say:"I love PHP"';
        echo $var50."的输出结果：";var_dump(filter_var($var50, FILTER_SANITIZE_STRIPPED));
        echo $var51."的输出结果：";var_dump(filter_var($var51, FILTER_SANITIZE_STRIPPED));
        echo $var52."的输出结果：";var_dump(filter_var($var52, FILTER_SANITIZE_STRIPPED));
        echo $var53."的输出结果：";var_dump(filter_var($var53, FILTER_SANITIZE_STRIPPED,FILTER_FLAG_NO_ENCODE_QUOTES));
        echo $var54."的输出结果：";var_dump(filter_var($var54, FILTER_SANITIZE_STRIPPED,FILTER_FLAG_NO_ENCODE_QUOTES));
    
        echo "----------------------FILTER_SANITIZE_URL的使用--------------------------------------------------------<br>";
        //该过滤器 过滤器删除字符串中所有非法的 URL 字符。
        $var50 = "<a href='http://php.net/manual/zh/filter.filters.validate.php'>http://php.net/manual/zh/filter.filters.validate.php</a>";
        $var51 = "http://php.net/manual/zh/filter.filters.validate.php";
        $var52 = "PHP&GO";
        $var53 = 'http://www.example.com/abc/index.php?q=abc��123';
        $var54 = 'http://www.w3cschooåøl.cøc';
        echo $var50."的输出结果：";var_dump(filter_var($var50, FILTER_SANITIZE_URL));
        echo $var51."的输出结果：";var_dump(filter_var($var51, FILTER_SANITIZE_URL));
        echo $var52."的输出结果：";var_dump(filter_var($var52, FILTER_SANITIZE_URL));
        echo $var53."的输出结果：";var_dump(filter_var($var53, FILTER_SANITIZE_URL));
        echo $var54."的输出结果：";var_dump(filter_var($var54, FILTER_SANITIZE_URL));
    
        echo "----------------------FILTER_UNSAFE_RAW的使用--------------------------------------------------------<br>";
        //过滤器不进行任何过滤，去除或编码特殊字符。该过滤器删除那些对应用程序有潜在危害的数据。它用于去除标签以及删除或编码不需要的字符。
        $var50 = "!#$%&'*+-/=?^_`{|}~@.[]\\\\\\";
        $var51 = "http://php.net/manual/zh/filter.filters.validate.php";
        $var52 = "PHP&GO";
        $var53 = 'She say:"I love PHP"';
        $var54 = 'http://www.w3cschooåøl.cøc';
        echo $var50."的输出结果：";var_dump(filter_var($var50, FILTER_UNSAFE_RAW,FILTER_FLAG_ENCODE_HIGH));
        echo $var51."的输出结果：";var_dump(filter_var($var51, FILTER_UNSAFE_RAW));
        echo $var52."的输出结果：";var_dump(filter_var($var52, FILTER_UNSAFE_RAW,FILTER_FLAG_ENCODE_AMP));
        echo $var53."的输出结果：";var_dump(filter_var($var53, FILTER_UNSAFE_RAW));
        echo $var54."的输出结果：";var_dump(filter_var($var54, FILTER_UNSAFE_RAW));

输出：

\----------------------FILTER\_SANITIZE\_EMAIL的使用--------------------------------------------------------  
Hello,这是一个email地址sensus@sensus.com的输出结果：

E:\wamp64\www\filter\index.php:12:string 'Helloemailsensus@sensus.com' (length=27)

1的输出结果：

E:\wamp64\www\filter\index.php:13:string '1' (length=1)

1的输出结果：

E:\wamp64\www\filter\index.php:14:string '1' (length=1)

1的输出结果：

E:\wamp64\www\filter\index.php:15:string '1' (length=1)

&'\*+-/=?^\_\`\{|\}~@.的输出结果：

E:\wamp64\www\filter\index.php:16:string '&'*+-=?^_`{|}~@.' (length=16)

\----------------------FILTER\_SANITIZE\_ENCODED的使用--------------------------------------------------------  
568158961@qq.com的输出结果：

E:\wamp64\www\filter\index.php:23:string '568158961%40qq.com' (length=18)

568158961qq.com的输出结果：

E:\wamp64\www\filter\index.php:24:string '568158961qq.com' (length=15)

http://fanyi.baidu.com/?aldtype=16047\#en/zh/Slashes的输出结果：

E:\wamp64\www\filter\index.php:25:string 'http%3A%2F%2Ffanyi.baidu.com%2F%3Faldtype%3D16047%23en%2Fzh%2FSlashes' (length=69)

\----------------------FILTER\_SANITIZE\_MAGIC\_QUOTES的使用--------------------------------------------------------  
'Hello PHP'的输出结果：

E:\wamp64\www\filter\index.php:35:string '\'Hello PHP\'' (length=13)

Peter's here!\\NJHH的输出结果：

E:\wamp64\www\filter\index.php:36:string 'Peter\'s here!\\NJHH' (length=20)

NULL的输出结果：

E:\wamp64\www\filter\index.php:37:string 'NULL' (length=4)

的输出结果：

E:\wamp64\www\filter\index.php:38:string ' ' (length=1)

1的输出结果：

E:\wamp64\www\filter\index.php:39:string '1' (length=1)

的输出结果：

E:\wamp64\www\filter\index.php:40:string '' (length=0)

\----------------------FILTER\_SANITIZE\_NUMBER\_FLOAT的使用--------------------------------------------------------  
5-2f+3.3pp的输出结果：

E:\wamp64\www\filter\index.php:51:string '5-2+33' (length=6)

100.10的输出结果：

E:\wamp64\www\filter\index.php:52:string '100.10' (length=6)

111,112,33的输出结果：

E:\wamp64\www\filter\index.php:53:string '111,112,33' (length=10)

1e1的输出结果：

E:\wamp64\www\filter\index.php:54:string '1e1' (length=3)

1的输出结果：

E:\wamp64\www\filter\index.php:55:string '1' (length=1)

的输出结果：

E:\wamp64\www\filter\index.php:56:string '' (length=0)

0的输出结果：

E:\wamp64\www\filter\index.php:57:string '0' (length=1)

\----------------------FILTER\_SANITIZE\_NUMBER\_INT的使用--------------------------------------------------------  
192.168.100.185的输出结果：

E:\wamp64\www\filter\index.php:66:string '192168100185' (length=12)

0的输出结果：

E:\wamp64\www\filter\index.php:67:string '0' (length=1)

a的输出结果：

E:\wamp64\www\filter\index.php:68:string '' (length=0)

……&\*%65.54……￥的输出结果：

E:\wamp64\www\filter\index.php:69:string '6554' (length=4)

1的输出结果：

E:\wamp64\www\filter\index.php:70:string '1' (length=1)

\----------------------FILTER\_SANITIZE\_SPECIAL\_CHARS的使用--------------------------------------------------------  
192.168.100.185的输出结果：

E:\wamp64\www\filter\index.php:78:string '192.168.100.185' (length=15)

70-33-D2-33-17-7D的输出结果：

E:\wamp64\www\filter\index.php:79:string '70-33-D2-33-17-7D' (length=17)

2001:0:2a7b:7ded:185b:3573:3f57:9b8d的输出结果：

E:\wamp64\www\filter\index.php:80:string '2001:0:2a7b:7ded:185b:3573:3f57:9b8d' (length=36)

q q 的输出结果：

E:\wamp64\www\filter\index.php:81:string '<span>q
    
q</span>' (length=41)

1的输出结果：

E:\wamp64\www\filter\index.php:82:string '1' (length=1)

\----------------------FILTER\_SANITIZE\_FULL\_SPECIAL\_CHARS的使用--------------------------------------------------------  
2222的输出结果：

E:\wamp64\www\filter\index.php:91:string '2222' (length=4)

PHP的输出结果：

E:\wamp64\www\filter\index.php:92:string 'PHP' (length=3)

2001:0:2a7b:7ded:185b:3573:3f57:9b8d的输出结果：

E:\wamp64\www\filter\index.php:93:string '2001:0:2a7b:7ded:185b:3573:3f57:9b8d' (length=36)

的输出结果：

E:\wamp64\www\filter\index.php:94:string ' ' (length=1)

DIV\\'\\DIV 的输出结果：

E:\wamp64\www\filter\index.php:95:string '<span>DIV\'\DIV</span>' (length=39)

\----------------------FILTER\_SANITIZE\_STRING的使用--------------------------------------------------------  
www.baidu.com 的输出结果：

E:\wamp64\www\filter\index.php:110:string 'www.baidu.com
        ' (length=22)

[http://php.net/manual/zh/filter.filters.validate.php][http_php.net_manual_zh_filter.filters.validate.php] 的输出结果：

E:\wamp64\www\filter\index.php:111:string 'http://php.net/manual/zh/filter.filters.validate.php' (length=52)

http://php.net/manual/zh/filter.filters.validate.php的输出结果：

E:\wamp64\www\filter\index.php:112:string 'http://php.net/manual/zh/filter.filters.validate.php' (length=52)

PHP&GO的输出结果：

E:\wamp64\www\filter\index.php:113:string 'PHP&GO' (length=10)

She say:"I love PHP"的输出结果：

E:\wamp64\www\filter\index.php:114:string 'She say:"I love PHP"' (length=20)

\----------------------FILTER\_SANITIZE\_STRIPPED的使用--------------------------------------------------------  
[http://php.net/manual/zh/filter.filters.validate.php][http_php.net_manual_zh_filter.filters.validate.php] 的输出结果：

E:\wamp64\www\filter\index.php:123:string 'http://php.net/manual/zh/filter.filters.validate.php' (length=52)

http://php.net/manual/zh/filter.filters.validate.php的输出结果：

E:\wamp64\www\filter\index.php:124:string 'http://php.net/manual/zh/filter.filters.validate.php' (length=52)

PHP&GO的输出结果：

E:\wamp64\www\filter\index.php:125:string 'PHP&GO' (length=6)

She say:"I love PHP"的输出结果：

E:\wamp64\www\filter\index.php:126:string 'She say:"I love PHP"' (length=20)

She say:"I love PHP"的输出结果：

E:\wamp64\www\filter\index.php:127:string 'She say:"I love PHP"' (length=20)

\----------------------FILTER\_SANITIZE\_URL的使用--------------------------------------------------------  
[http://php.net/manual/zh/filter.filters.validate.php][http_php.net_manual_zh_filter.filters.validate.php] 的输出结果：

E:\wamp64\www\filter\index.php:136:string '<ahref='http://php.net/manual/zh/filter.filters.validate.php'>http://php.net/manual/zh/filter.filters.validate.php</a>' (length=118)

http://php.net/manual/zh/filter.filters.validate.php的输出结果：

E:\wamp64\www\filter\index.php:137:string 'http://php.net/manual/zh/filter.filters.validate.php' (length=52)

PHP&GO的输出结果：

E:\wamp64\www\filter\index.php:138:string 'PHP&GO' (length=6)

http://www.example.com/abc/index.php?q=abc��123的输出结果：

E:\wamp64\www\filter\index.php:139:string 'http://www.example.com/abc/index.php?q=abc123' (length=45)

http://www.w3cschooåøl.cøc的输出结果：

E:\wamp64\www\filter\index.php:140:string 'http://www.w3cschool.cc' (length=23)

\----------------------FILTER\_UNSAFE\_RAW的使用--------------------------------------------------------  
!\#$%&'\*+-/=?^\_\`\{|\}~@.\[\]\\\\\\的输出结果：

E:\wamp64\www\filter\index.php:149:string '!#$%&'*+-/=?^_`{|}~@.[]\\\' (length=26)

http://php.net/manual/zh/filter.filters.validate.php的输出结果：

E:\wamp64\www\filter\index.php:150:string 'http://php.net/manual/zh/filter.filters.validate.php' (length=52)

PHP&GO的输出结果：

E:\wamp64\www\filter\index.php:151:string 'PHP&GO' (length=10)

She say:"I love PHP"的输出结果：

E:\wamp64\www\filter\index.php:152:string 'She say:"I love PHP"' (length=20)

http://www.w3cschooåøl.cøc的输出结果：

E:\wamp64\www\filter\index.php:153:string 'http://www.w3cschooåøl.cøc' (length=29)

[20180102114358395]: /images/20220602/08b3673949f24dfe89a608496b89a840.png
[20180102114435211]: /images/20220602/fc5693129fd04070a844c4ed2a097147.png
[http_php.net_manual_zh_filter.filters.validate.php]: http://php.net/manual/zh/filter.filters.validate.php