Bug #70042 [NEW]: FILTER_SANITIZE_STRING stripping out portion of string

From: tom dot noel at lgh-usa dot com Operating system: Ubuntu PHP version: 5.6.11 Package: *General Issues Bug Type: Bug Bug description:FILTER_SANITIZE_STRING stripping out portion of string Description: ------------ When running a basic query through the filter_var function using FILTER_SANITIZE_STRING and FILER_FLAG_NO_ENCODE_QUOTES a portion of my string is being stripped out that shouldn't be. Test script: --------------- $sql = "SELECT customer, kdaccount, expDateMonth, expDateYear, nameid FROM creditcard_main WHERE ((expDateYear = '2016' AND expDateMonth <= '01') OR (expDateYear >= '2015' AND expDateMonth >= '07')) AND cardStatus = '1' AND cardAuthorized = '1' ORDER BY kdaccount ASC LIMIT 0, 25"; $query = filter_var ($sql, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES);die; Expected result: ---------------- Should be identical to original string: $query = "SELECT customer, kdaccount, expDateMonth, expDateYear, nameid FROM creditcard_main WHERE ((expDateYear = '2016' AND expDateMonth <= '01') OR (expDateYear >= '2015' AND expDateMonth >= '07')) AND cardStatus = '1' AND cardAuthorized = '1' ORDER BY kdaccount ASC LIMIT 0, 25" Actual result: -------------- $query = "SELECT customer, kdaccount, expDateMonth, expDateYear, nameid FROM creditcard_main WHERE ((expDateYear = '2016' AND expDateMonth = '2015' AND expDateMonth >= '07')) AND cardStatus = '1' AND cardAuthorized = '1' ORDER BY kdaccount ASC LIMIT 0, 25" -- Edit bug report at https://bugs.php.net/bug.php?id=70042&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70042&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70042&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70042&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70042&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70042&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70042&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70042&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70042&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70042&r=support Expected behavior: https://bugs.php.net/fix.php?id=70042&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70042&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70042&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70042&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70042&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70042&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70042&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70042&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70042&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70042&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70042&r=mysqlcfg