<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Clean input variable PHP</title>
	<atom:link href="http://ditio.net/2008/06/29/clean-input-variable-php/feed/" rel="self" type="application/rss+xml" />
	<link>http://ditio.net/2008/06/29/clean-input-variable-php/</link>
	<description>Practical guide to web development, marketing and programming</description>
	<lastBuildDate>Tue, 07 Sep 2010 06:17:00 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
	<item>
		<title>By: Wilfred Sikel</title>
		<link>http://ditio.net/2008/06/29/clean-input-variable-php/comment-page-1/#comment-38024</link>
		<dc:creator>Wilfred Sikel</dc:creator>
		<pubDate>Wed, 14 Apr 2010 08:01:13 +0000</pubDate>
		<guid isPermaLink="false">http://ditio.net/?p=26#comment-38024</guid>
		<description>Superb Post. Niftier then the simillar post I checked 2 days ago on Wordpress. Maintain the good work.</description>
		<content:encoded><![CDATA[<p>Superb Post. Niftier then the simillar post I checked 2 days ago on WordPress. Maintain the good work.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Matt</title>
		<link>http://ditio.net/2008/06/29/clean-input-variable-php/comment-page-1/#comment-32552</link>
		<dc:creator>Matt</dc:creator>
		<pubDate>Sun, 14 Feb 2010 07:01:53 +0000</pubDate>
		<guid isPermaLink="false">http://ditio.net/?p=26#comment-32552</guid>
		<description>This is nice, however you&#039;re missing one important aspect... GET and POST arrays can have arrays as values, so this will fail to clean them (and may infact throw a PHP error as well).

Recursive functions come in handy here...
function __stripslashes($var)
{
	$var = is_array($var) ? array_map(&#039;__stripslashes&#039;, $var) : stripslashes($var);

	return $var;
}
function __htmlspecialchars($var, $style)
{
	$var = is_array($var) ? array_map(&#039;__htmlspecialchars&#039;, $var, array_fill(0, count($var), $style)) : htmlspecialchars($var, $style);

	return $var;
}
$_GET = __stripslashes($_GET);
$_GET = __htmlspecialchars($_GET, ENT_QUOTES);</description>
		<content:encoded><![CDATA[<p>This is nice, however you&#8217;re missing one important aspect&#8230; GET and POST arrays can have arrays as values, so this will fail to clean them (and may infact throw a PHP error as well).</p>
<p>Recursive functions come in handy here&#8230;<br />
function __stripslashes($var)<br />
{<br />
	$var = is_array($var) ? array_map(&#8216;__stripslashes&#8217;, $var) : stripslashes($var);</p>
<p>	return $var;<br />
}<br />
function __htmlspecialchars($var, $style)<br />
{<br />
	$var = is_array($var) ? array_map(&#8216;__htmlspecialchars&#8217;, $var, array_fill(0, count($var), $style)) : htmlspecialchars($var, $style);</p>
<p>	return $var;<br />
}<br />
$_GET = __stripslashes($_GET);<br />
$_GET = __htmlspecialchars($_GET, ENT_QUOTES);</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: dave</title>
		<link>http://ditio.net/2008/06/29/clean-input-variable-php/comment-page-1/#comment-30663</link>
		<dc:creator>dave</dc:creator>
		<pubDate>Sat, 02 Jan 2010 21:32:32 +0000</pubDate>
		<guid isPermaLink="false">http://ditio.net/?p=26#comment-30663</guid>
		<description>Jolly Joker.  it does work.  Thank you Charles.</description>
		<content:encoded><![CDATA[<p>Jolly Joker.  it does work.  Thank you Charles.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: jolly joker</title>
		<link>http://ditio.net/2008/06/29/clean-input-variable-php/comment-page-1/#comment-30356</link>
		<dc:creator>jolly joker</dc:creator>
		<pubDate>Sat, 26 Dec 2009 02:52:41 +0000</pubDate>
		<guid isPermaLink="false">http://ditio.net/?p=26#comment-30356</guid>
		<description>charlies solution is known to work, it never fails.</description>
		<content:encoded><![CDATA[<p>charlies solution is known to work, it never fails.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Charlie</title>
		<link>http://ditio.net/2008/06/29/clean-input-variable-php/comment-page-1/#comment-26113</link>
		<dc:creator>Charlie</dc:creator>
		<pubDate>Thu, 17 Sep 2009 16:39:02 +0000</pubDate>
		<guid isPermaLink="false">http://ditio.net/?p=26#comment-26113</guid>
		<description>edit: the function is missing a &quot;return $data;&quot; line at the end.</description>
		<content:encoded><![CDATA[<p>edit: the function is missing a &#8220;return $data;&#8221; line at the end.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Charlie</title>
		<link>http://ditio.net/2008/06/29/clean-input-variable-php/comment-page-1/#comment-26112</link>
		<dc:creator>Charlie</dc:creator>
		<pubDate>Thu, 17 Sep 2009 16:38:19 +0000</pubDate>
		<guid isPermaLink="false">http://ditio.net/?p=26#comment-26112</guid>
		<description>@Gustavo and everyone else

You can simplify, you don&#039;t need to assign the variable to a variable to the function results. i.e. instead of 

&lt;code&gt;$cleanPost = array_map(’confHtmlEnt’, $_GET);
$_GET=$cleanPost;&lt;/code&gt;

do

&lt;code&gt;$_GET = array_map(’confHtmlEnt’, $_GET);&lt;/code&gt;

A nice function is

&lt;code&gt;
function cleanData($data) {
     $data = trim($data);
     $data = htmlentities($data);
     $data = mysql_real_escape_string($data);
}

$_POST = array_map(&#039;cleanData&#039;, $_POST);
&lt;/code&gt;</description>
		<content:encoded><![CDATA[<p>@Gustavo and everyone else</p>
<p>You can simplify, you don&#8217;t need to assign the variable to a variable to the function results. i.e. instead of </p>
<p><code>$cleanPost = array_map(’confHtmlEnt’, $_GET);<br />
$_GET=$cleanPost;</code></p>
<p>do</p>
<p><code>$_GET = array_map(’confHtmlEnt’, $_GET);</code></p>
<p>A nice function is</p>
<p><code><br />
function cleanData($data) {<br />
     $data = trim($data);<br />
     $data = htmlentities($data);<br />
     $data = mysql_real_escape_string($data);<br />
}</p>
<p>$_POST = array_map('cleanData', $_POST);<br />
</code></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Gustavo</title>
		<link>http://ditio.net/2008/06/29/clean-input-variable-php/comment-page-1/#comment-24354</link>
		<dc:creator>Gustavo</dc:creator>
		<pubDate>Sun, 09 Aug 2009 05:34:43 +0000</pubDate>
		<guid isPermaLink="false">http://ditio.net/?p=26#comment-24354</guid>
		<description>Thanks Greg,
That is what i was looking for,not perfect but enough; now i can use GET,POST with more confidence, doing something simple:

function confHtmlEnt($data)
{...}
 
$cleanPost = array_map(&#039;confHtmlEnt&#039;, $_GET); 
$_GET=$cleanPost;
And avoid analizing my vars case by case.</description>
		<content:encoded><![CDATA[<p>Thanks Greg,<br />
That is what i was looking for,not perfect but enough; now i can use GET,POST with more confidence, doing something simple:</p>
<p>function confHtmlEnt($data)<br />
{&#8230;}</p>
<p>$cleanPost = array_map(&#8216;confHtmlEnt&#8217;, $_GET);<br />
$_GET=$cleanPost;<br />
And avoid analizing my vars case by case.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: sector</title>
		<link>http://ditio.net/2008/06/29/clean-input-variable-php/comment-page-1/#comment-23789</link>
		<dc:creator>sector</dc:creator>
		<pubDate>Fri, 31 Jul 2009 08:28:28 +0000</pubDate>
		<guid isPermaLink="false">http://ditio.net/?p=26#comment-23789</guid>
		<description>Great post about variable cleaning! I&#039;ve been usually cleaning the input already when storing it to a variable, this way I don&#039;t have to worry about it anymore. However, in some cases I might want to be able to see what the user has really entered.</description>
		<content:encoded><![CDATA[<p>Great post about variable cleaning! I&#8217;ve been usually cleaning the input already when storing it to a variable, this way I don&#8217;t have to worry about it anymore. However, in some cases I might want to be able to see what the user has really entered.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
