PHP Classes


Recommend this page to a friend!
  Classes of Leo Daidone   PHP Sanitize Class   Download  
Role: Documentation
Content type: text/markdown
Description: README
Class: PHP Sanitize Class
Validate and sanitize string values
Author: By
Last change: Update of
Date: 1 month ago
Size: 3,210 bytes


Class file image Download


This package is a set of classes that will help to validate/sanitize the main set of types listed in OWASP, through a PHPSanitizer wrapper class.

It allows to create new validation classes for customs types by extending AbstractSanitizer class and implements ISanitizer interface.


First, get an instance of PHPSanitizer, you can do that through ClassLoader class:

    $base_path = dirname(__FILE__).'/<path_to_PHPSanitizer>/';
    ClassLoader::Load('PHPSanitizer', $base_path);
    $sanitizer = PHPSanitizer::getInstance();

or just:

    $sanitizer = PHPSanitizer::getInstance();

by default it uses "PARANOID" validation, you can change type using setType($type, $custom_name, $base_path) method, where $type can be one of:

  • PHPSanitizer::PARANOID
  • PHPSanitizer::SQL
  • PHPSanitizer::SYSTEM
  • PHPSanitizer::HTML
  • PHPSanitizer::INT
  • PHPSanitizer::FLOAT
  • PHPSanitizer::LDAP
  • PHPSanitizer::UTF8
  • PHPSanitizer::CUSTOM

In case of PHPSanitizer::CUSTOM, $custom_name is required following naming rules that will be detailed in Extends section. $base_path is optional. This is used to change default path for Sanitizers classes, defaulted in factories directory under the path to SanitizerFactory class.

There are two method available in $sanitizer instance: validate($string) and cleanup($string)

sanitizer->validate($string); //return a boolean

$sanitizer->cleanup($string); //returns an string with all invalid characters removed


To create a new CUSTOM sanitizer, you just need to extend AbstractSanitizer class and implements ISanitizer interface.

    // This file is under examples/factories/.
    class SanitizerEmail extends AbstractSanitizer implements ISanitizer{
        private $pattern = "/^.+\@(\[?)[a-zA-Z0-9\-\.]+\.([a-zA-Z]{2,4}|[0-9]{1,4})(\]?)$/";
        private $pattern_replace = "/[\;\#\n\r\*\'\"<>&\%\!\(\)\{\}\[\]\?\\/\s,]/";
        private $replacement = "";
        public function validate($string){
            return preg_match($this->pattern, $string);
        public function cleanup($email){
            $email = trim($email);
            $email = str_replace(" ", "", $email);
                throw new Exception('Invalid email address');
            return preg_replace($this->pattern_replace, $this->replacement, $email);

Naming convention

  • Class file name should be camelized, starting with "Sanitizer" followed by type name
  • Class name should be camelized, starting with "Sanitizer" followed by type name
  • Custom name should be camelized type ("Sanitizer" will be added automatically by Factory class)