Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:27998
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 64.233.162.229 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
        b=K/3QhaNyn9rkxKBGGPpLRMBl4vhAIz7x6zQNMtcD9P0lhPGEn7WpGGrUXCePUk79DwZl9ulO3QdXMCK2rUy3eQzuHm/rBYqgsWleF2eSkGulyvybszM+xT97YqskEu8TOwKpGTNfKANs3ICBghQ2/94yUj8Qp4kdNYyyrsYZF5g=
Message-ID: <99cd336d0702102348o10288e12k2d4e795e0f515819@mail.gmail.com>
Date: Sun, 11 Feb 2007 18:18:58 +1030
To: internals@lists.php.net
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Subject: filter_var options effect \0 even if it FILTER_FLAG_STRIP_LOW not used?
From: slackmase2@gmail.com ("Andy Mason")

Hi all, I'm not really sure if this is the correct list to place this
on. Apologies if it is not. I've come across some un-expected
behaviour in the new filter_var function but i'm not really sure if
it's just me not understanding the documentation correctly.

I have the following two functions which should filter the HIGH ascii
chars and manually strip the LOW ascii chars (so as to allow through
\r \n"

If the line
$input =  filter_var( $input, FILTER_SANITIZE_STRING,
FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_ENCODE_AMP |
FILTER_NULL_ON_FAILURE);

is executed before manually searching for characters like \0 , it
appears to effect the ability for mb_strpos to identify low numbered
ascii characters.

Is the filter_var function automagically removing the \0 ? I'm not
saying this is bad in anyway. I can't imagine what you would want/need
a null byte for in PHP :)

just wanted to check that this is in fact the behaviour that is
expected, as I wasn't expecting it from what the docs said.


#!/usr/bin/php
<?php


        function test1( $input )
        {
            // we want the outcome to be false
            $haslownum = false;
            for( $i = 0; $i< 32 ;$i++)
            {
                // 13 is CR carriage return
                if( ($i != 10 && $i != 13 ) && mb_strpos($input,chr($i)) )
                {
                    $haslownum = true;
                    $input = null;
                    break;
                }
            }
            $input =  filter_var( $input, FILTER_SANITIZE_STRING,
FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_ENCODE_AMP |
FILTER_NULL_ON_FAILURE);

            return $input;
        }

        function test2( $input )
        {
            $input =  filter_var( $input, FILTER_SANITIZE_STRING,
FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_ENCODE_AMP |
FILTER_NULL_ON_FAILURE);

            // we want the outcome to be false
            $haslownum = false;
            for( $i = 0; $i< 32 ;$i++)
            {
                // 13 is CR carriage return
                if( ($i != 10 && $i != 13 ) && mb_strpos($input,chr($i)) )
                {
                    $haslownum = true;
                    $input = null;
                }
            }


            return $input;
        } // end filter_for_db_allow_cr


$input = "myname\0.php";

$input = test1($input);

echo "Test #1 should be null : ".$input."\n";

$input = "myname\0.php";
$input = test2($input);

echo "Test #2 should be null? : ".$input."\n";