InputFilter Class Reference

Public Member Functions
	inputFilter ($tagsArray=array(), $attrArray=array(), $tagsMethod=0, $attrMethod=0, $xssAuto=1)
	process ($source)
	remove ($source)
	filterTags ($source)
	filterAttr ($attrSet)
	badAttributeValue ($attrSubSet)
	decode ($source)
	safeSQL ($source, &$connection)
	quoteSmart ($source, &$connection)
	escapeString ($string, &$connection)
Data Fields
	$tagsArray
	$attrArray
	$tagsMethod
	$attrMethod
	$xssAuto
	$tagBlacklist = array ('applet', 'body', 'bgsound', 'base', 'basefont', 'embed', 'frame', 'frameset', 'head', 'html', 'id', 'iframe', 'ilayer', 'layer', 'link', 'meta', 'name', 'object', 'script', 'style', 'title', 'xml')
	$attrBlacklist = array ('action', 'background', 'codebase', 'dynsrc', 'lowsrc')

---

Detailed Description

, with comments) : PHP Input Filter

Date:

: 10-05-2005

Version:

: 1.2.2_php4/php5

Author:

: Daniel Morris : Gianpaolo Racca, Ghislain Picard, Marco Wandschneider, Chris Tobin and Andrew Eddie.

Modification by Louis Landry

: Daniel Morris : dan@rootcube.com : GNU General Public License (GPL)

Definition at line 17 of file inputfilter.php.

---

Member Function Documentation

badAttributeValue

(

$

attrSubSet

)

Function to determine if contents of an attribute is safe

protected

Parameters:

array

$attrSubSet A 2 element array for attributes name,value

Returns:

boolean True if bad code is detected

Definition at line 437 of file inputfilter.php.

Referenced by filterAttr().

decode

(

$

source

)

Try to convert to plaintext

protected

Parameters:

string

$source

Returns:

string Plaintext string

Definition at line 451 of file inputfilter.php.

Referenced by process(), and safeSQL().

escapeString	(	$	string,
		&$	connection
	)

Author:

Chris Tobin

Daniel Morris

protected

Parameters:

	string	$source
	resource	$connection An open MySQL connection

Returns:

string Escaped string

Definition at line 537 of file inputfilter.php.

Referenced by quoteSmart().

filterAttr

(

$

attrSet

)

Internal method to strip a tag of certain attributes

protected

Parameters:

array

$attrSet Array of attribute pairs to filter

Returns:

array $newSet Filtered array of attribute pairs

Definition at line 334 of file inputfilter.php.

References badAttributeValue().

Referenced by filterTags().

filterTags

(

$

source

)

Internal method to strip a string of certain tags

protected

Parameters:

string

$source Input string to be 'cleaned'

Returns:

string $source 'cleaned' version of input parameter

Definition at line 127 of file inputfilter.php.

References filterAttr().

Referenced by remove().

inputFilter	(	$	tagsArray = array (),
		$	attrArray = array (),
		$	tagsMethod = 0,
		$	attrMethod = 0,
		$	xssAuto = 1
	)

Constructor for inputFilter class. Only first parameter is required.

protected

Parameters:

	array	$tagsArray list of user-defined tags
	array	$attrArray list of user-defined attributes
	int	$tagsMethod WhiteList method = 0, BlackList method = 1
	int	$attrMethod WhiteList method = 0, BlackList method = 1
	int	$xssAuto Only auto clean essentials = 0, Allow clean blacklisted tags/attr = 1

Definition at line 40 of file inputfilter.php.

process

(

$

source

)

Method to be called by another php script. Processes for XSS and specified bad code.

public

Parameters:

mixed

$source Input string/array-of-string to be 'cleaned'

Returns:

mixed $source 'cleaned' version of input parameter

Definition at line 66 of file inputfilter.php.

References decode().

quoteSmart	(	$	source,
		&$	connection
	)

Method to escape a string

Author:

Chris Tobin

Daniel Morris

protected

Parameters:

	string	$source
	resource	$connection An open MySQL connection

Returns:

string Escaped string

Definition at line 511 of file inputfilter.php.

References escapeString().

Referenced by safeSQL().

remove

(

$

source

)

Internal method to iteratively remove all unwanted tags and attributes

protected

Parameters:

string

$source Input string to be 'cleaned'

Returns:

string $source 'cleaned' version of input parameter

Definition at line 106 of file inputfilter.php.

References filterTags().

safeSQL	(	$	source,
		&$	connection
	)

Method to be called by another php script. Processes for SQL injection

public

Parameters:

	mixed	$source input string/array-of-string to be 'cleaned'
	resource	$connection - An open MySQL connection

Returns:

string 'cleaned' version of input parameter

Definition at line 470 of file inputfilter.php.

References decode(), and quoteSmart().

---

The documentation for this class was generated from the following file:

• libraries/phpinputfilter/inputfilter.php