#41250 [NEW]: Filter SANITIZE_STRING only filters backslash when escaping

From: david at emomentum dot co dot uk Operating system: Windows XP PHP version: 5CVS-2007-05-01 (snap) PHP Bug Type: Filter related Bug description: Filter SANITIZE_STRING only filters backslash when escaping Description: ------------ The filter FILTER_SANITIZE_STRING only filters out a backslash when it is escaping something. This means if a backslash is entered into a form without escaping anything, it will not be filtered and could be executed into SQL, therefore triggering an escape within the SQL and generating an error. Reproduce code: --------------- <?php $value = '\'example'; echo filter_var($value, FILTER_SANITIZE_STRING).'<br />'; $value = '\example'; echo filter_var($value, FILTER_SANITIZE_STRING).'<br />'; ?> Expected result: ---------------- 'example example Actual result: -------------- 'example \example -- Edit bug report at http://bugs.php.net/?id=41250&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=41250&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=41250&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=41250&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=41250&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=41250&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=41250&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=41250&r=needscript Try newer version: http://bugs.php.net/fix.php?id=41250&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=41250&r=support Expected behavior: http://bugs.php.net/fix.php?id=41250&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=41250&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=41250&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=41250&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=41250&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=41250&r=dst IIS Stability: http://bugs.php.net/fix.php?id=41250&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=41250&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=41250&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=41250&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=41250&r=mysqlcfg