Would this function be sufficient enough to remove all malicious code and foreign characters from a string?

//Clean the string
$out = ltrim($do);
$out = rtrim($out);
$out = preg_replace('/[^(\x20-\x7F)]*/','', strip_tags($out)); 

This data is not going into a SQL database, so I dont have to worry about sql injection attempts. Is there any way to improve my code and make it more efficient?

This function would clean any user inputted data (forms, and ?), and then save it do a database. This would be used in a global sanitizing function.

  • 2
    \$\begingroup\$ How are you using this string that you are worried about it being an attack vector? Where is the string coming from? What do you expect it to contain? Please add that to the question. \$\endgroup\$ Commented Jan 21, 2011 at 18:09
  • 6
    \$\begingroup\$ The context is still not clear of what you are trying to prevent injection of. \$\endgroup\$ Commented Jan 21, 2011 at 19:50
  • \$\begingroup\$ $out = preg_replace('/[^(\x20-\x7F)]*/','', strip_tags(rtrim(ltrim($do)))); \$\endgroup\$
    – Shoe
    Commented Jan 25, 2011 at 15:33

2 Answers 2


That one is quite simple (for me at least) since there is a very general answer :)


There is no way you can ever really safely "repair" user input.

"Please provide a list of everything you shouldn't to with a hammer"

is way harder than

"list all appropriate uses of a hammer".

You might forget one or two but no harm done there if you go back and add them.

It might sound harsh but something will always byte you and if it's only EVAL(UNHEX(ASD23426363)) or something like that. (Sql example even so you did say it not sql but whatever).

Of course you might want to do things like strip out tags out of input for html context anyways so that a hole in your other code is not as easily exploited and less damage will be done but i shouldn't be your only defense.

Someone that said Filter Input, Escape Output way better than i could. Terry Chay

In short: Whatever you are doing there, find the appropriate escaping function and use it.

Shell context ? escapeshellarg

Html context ? htmlspecialchars

Database context ? Use prepared statements and never worry about sql injection again

Little edit: I know what i said and the blog post contradict a little but thats fine with me. 'In practice' will always differ from general advice and sometimes you want to do everything you can ;)


I'm doing a copy-pasta from My Answer to a similar question on SO:

Always remember, Filter In, Escape Out for all user supplied (or untrusted) input.

When reading user supplied data, filter it to known values. DO NOT BLACKLIST! Always always always always whitelist what you are expecting to get. If you're expecting a hex number, validate it with a regex like: ^[a-f0-9]+$. Figure out what you expect, and filter towards that. Do none of your filenames have anything but alpha, numeric and .? Then filter to ^[a-z0-9.]+$. But don't start thinking blacklisting against things. It won't work.

When using user-data, escape it properly for the use at hand. If it's going in a database, either bind it as a parameterized query, or escape it with the database's escape function. If you're calling a shell command, escape it with escapeshellarg(). If you're using it in a regex pattern, escape it with preg_quote(). There are more than that, but you get the idea.

When outputting user data, escape it properly for the format you're outputting it as. If you're outputting it to HTML or XML, use htmlspecialchars(). If you're outputting to raw headers for some reason, escape any linebreaks (str_replace(array("\r", "\n"), array('\r', '\n'), $string)). Etc, etc, etc.

But always filter using a white-list, and always escape using the correct method for the context. Otherwise there's a significant chance you'll miss something...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.