This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit


Jump to: navigation, search

Project Overview

A collection of easy to include PHP functions that sanitize user inputs. Functions available are...

  • sanitize_paranoid_string($string) -- input string, returns string stripped of all non alphanumeric characters
  • sanitize_system_string($string) -- input string, returns string stripped of special characters
  • sanitize_sql_string($string) -- input string, returns string with slashed out quotes
  • sanitize_html_string($string) -- input string, returns string with html replacements for special characters
  • sanitize_int($integer) -- input integer, returns ONLY the integer (no extraneous characters
  • sanitize_float($float) -- input float, returns ONLY the float (no extraneous characters)
  • sanitize($input, $flags) -- input any variable, performs sanitization functions specified in flags. flags can be bitwise combination of PARANOID, SQL, SYSTEM, HTML, INT, FLOAT, LDAP, UTF8


Gavin Zuchlinski, Jamie Pratt [jpratt at norwich dot edu], Hokkaido


The PHP Filters are made public so that you can extend them and give back improvements to the community. The original authors would rank these as the highest priority suggestions, other suggestions are also below. If you make changes, please be sure to share your improvements and mail [email protected] with the code and all details of improvements. The license requires this but your karma far outweighs that anyway !


You can download the code to this tool at