Constant FILTER_SANITIZE_STRING is deprecated

Solution 1:

This was a filter of dubious purpose. It's difficult to say what it was meant to accomplish exactly or when it should be used. It was also confused with the default string filter, due to its name, when in reality the default string filter is called FILTER_UNSAFE_RAW. The PHP community decided that the usage of this filter should not be supported anymore.

The behaviour of this filter was very unintuitive. It removed everything between < and the end of the string or until the next >. It also removed all NUL bytes. Finally, it encoded ' and " into their HTML entities.

If you want to replace it, you have a couple of options:

1. Use the default string filter FILTER_UNSAFE_RAW that doesn't do any filtering. This should be used if you had no idea about the behaviour of FILTER_SANITIZE_STRING and you just want to use a default filter that will give you the string value.

2. If you used this filter to protect against XSS vulnerabilities, then replace its usage with htmlspecialchars(). Don't call this function on the input data. To protect against XSS you need to encode the output!

3. If you knew exactly what that filter does and you want to create a polyfill, you can do that easily with regex.

   function filter_string_polyfill(string $string): string
   {
       $str = preg_replace('/\x00|<[^>]*>?/', '', $string);
       return str_replace(["'", '"'], ['&#39;', '&#34;'], $str);
   }
   

Don’t try to sanitize input. Escape output.

Solution 2:

The closest constant you can use instead, if you intend to convert your variable in a safe html string, is FILTER_SANITIZE_FULL_SPECIAL_CHARS