note 129098 added to filter.filters.sanitize

With the deprecation of FILTER_SANITIZE_STRING, the "use htmlspecialchars instead" is an incomplete comment. The functionality of FILTER_SANITIZE_STRING was a combination of htmlspcialchars and (approximately) strip_tags. For true compatibility a polyfil may be needed: <?php function filter_string_polyfill(string $string): string { $str = preg_replace('/\x00|<[^>]*>?/', '', $string); return str_replace(["'", '"'], ['&#39;', '&#34;'], $str); } $string = "Some \"' <bizzare> string & to Sanitize < !$@%"; echo filter_var($string,FILTER_SANITIZE_STRING).PHP_EOL; //Some &#34;&#39; string & to Sanitize echo htmlspecialchars($string).PHP_EOL; //Some &quot;&#039; &lt;bizzare&gt; string &amp; to Sanitize &lt; !$@% echo strip_tags($string).PHP_EOL; //Some "' string & to Sanitize < !$@% echo htmlspecialchars(strip_tags($string,ENT_QUOTES)).PHP_EOL; //Some &quot;&#039; string &amp; to Sanitize &lt; !$@% echo filter_string_polyfill($string).PHP_EOL; //Some &#34;&#39; string & to Sanitize ---- Server IP: 45.112.84.4 Probable Submitter: 45.91.157.134 (proxied: 76.20.178.25) ---- Manual Page -- https://php.net/manual/en/filter.filters.sanitize.php Edit -- https://main.php.net/note/edit/129098 Del: integrated -- https://main.php.net/note/delete/129098/integrated Del: useless -- https://main.php.net/note/delete/129098/useless Del: bad code -- https://main.php.net/note/delete/129098/bad+code Del: spam -- https://main.php.net/note/delete/129098/spam Del: non-english -- https://main.php.net/note/delete/129098/non-english Del: in docs -- https://main.php.net/note/delete/129098/in+docs Del: other reasons-- https://main.php.net/note/delete/129098 Reject -- https://main.php.net/note/reject/129098 Search -- https://main.php.net/manage/user-notes.php