/**
* Strip any unsafe tags/chars/attributes from input values.
*
* @param string Value to be cleaned
* @param boolean Strip \r\n ?
* @return string
*/
function sanitize($value, $strip_crlf = true)
{
// Some of what we have in the $search array may not be needed, but let's be safe.
$search = array(
'@<script[^>]*?>.*?</script>@si',
'@<applet[^>]*?>.*?</applet>@si',
'@<object[^>]*?>.*?</object>@si',
'@<iframe[^>]*?>.*?</iframe>@si',
'@<style[^>]*?>.*?</style>@si',
'@<form[^>]*?>.*?</form>@si',
'@<[\/\!]*?[^<>]*?>@si',
'@&(?!(#[0-9]+|[a-z]+);)@si'
);
if ($strip_crlf)
{
array_push($search, '@([\r\n])[\s]+@');
}
$value = preg_replace($search, '', $value);
// Make sure we get everything..
$value = strip_tags($value);
return clean($value);
}
/**
* Cleans either a string, or can clean an entire array of values:
* clean($array);
*
* @param mixed Value to be cleaned
* @return mixed
*/
function clean($value)
{
if (is_array($value))
{
foreach ($value AS $key => $val)
{
if (is_string($val))
{
$value["$key"] = trim(stripslashes($val));
}
else if (is_array($val))
{
$value["$key"] = clean($value["$key"]);
}
}
return $value;
}
return trim(stripslashes($value));
}
