Bug #60541 [Bgs]: FILTER_SANITIZE_NUMBER_INT fails to filter strings with plus and minus

Edit report at https://bugs.php.net/bug.php?id=60541&edit=1 ID: 60541 Updated by: cataphract@php.net Reported by: klaussilveira@php.net Summary: FILTER_SANITIZE_NUMBER_INT fails to filter strings with plus and minus Status: Bogus Type: Bug Package: Filter related Operating System: UNIX PHP Version: 5.3.8 Block user comment: N Private report: N New Comment: Nothing says it should return a valid integer, just like the e-mail sanitization filter doesn't have to return a valid e-mail. Previous Comments: ------------------------------------------------------------------------ [2011-12-17 17:23:12] klaussilveira@php.net Yes, it matches the documentation. But filtering "ad--td#$@++qsdh-3" and returning "--++-3" is wrong. The filter is not implemented correctly, it should remove all + and - characters that are not next to a number. Filtering "ad--td#$@++qsdh-3" should return "-3", that's a valid integer. ------------------------------------------------------------------------ [2011-12-17 14:31:51] cataphract@php.net Plus, this matches perfectly the documentation ("Remove all characters except digits, plus and minus sign.") ------------------------------------------------------------------------ [2011-12-17 14:31:16] cataphract@php.net The purpose of the sanitisation filters is not to transform data so as to make it valid, it merely "removes undesirable characters" (see http://php.net/manual/en/intro.filter.php ). Though this description is not entirely correct (for instance FILTER_SANITIZE_SPECIAL_CHARS with FILTER_FLAG_ENCODE_HIGH will transform some characters into HTML entities -- in a rather flawed way, I must say, because it arbitrarily assumes a sort of ISO-8859-1 extension), what is clear is that data may very well still be invalid after running the sanitisation filters. ------------------------------------------------------------------------ [2011-12-16 00:17:30] klaussilveira@php.net The most elegant solution was to detect only + and - signs that are next to a number, and remove all others. For example: filter_var("ad--td#$@++qsdh-3", FILTER_SANITIZE_NUMBER_INT); // returns -3 Right now, the filter behavior is: filter_var("ad--td#$@++qsdh-3", FILTER_SANITIZE_NUMBER_INT); // returns --++-3 Which is VERY bad and HORRIBLY wrong. ------------------------------------------------------------------------ [2011-12-16 00:07:42] klaussilveira@php.net The following patch has been added/updated: Patch Name: sanitize_integers Revision: 1323994062 URL: https://bugs.php.net/patch-display.php?bug=60541&patch=sanitize_integers&revision=1323994062 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=60541 -- Edit this bug report at https://bugs.php.net/bug.php?id=60541&edit=1