$filename_bad_chars
$filename_bad_chars : array
List of sanitize filename strings
Security Class
csrf_verify() : \CI_Security
CSRF Verify
csrf_set_cookie() : \CI_Security
CSRF Set Cookie
xss_clean(string|array<mixed,string> $str, boolean $is_image = FALSE) : string
XSS Clean
Sanitizes data so that Cross Site Scripting Hacks can be prevented. This method does a fair amount of work but it is extremely thorough, designed to prevent even the most obscure XSS attempts. Nothing is ever 100% foolproof, of course, but I haven't been able to get anything passed the filter.
Note: Should only be used to deal with data upon submission. It's not something that should be used for general runtime processing.
| string|array<mixed,string> | $str | Input data |
| boolean | $is_image | Whether the input is an image |
entity_decode(string $str, string $charset = NULL) : string
HTML Entities Decode
A replacement for html_entity_decode()
The reason we are not using html_entity_decode() by itself is because while it is not technically correct to leave out the semicolon at the end of an entity most browsers will still interpret the entity correctly. html_entity_decode() does not convert entities without semicolons, so we are left with our own little solution here. Bummer.
| string | $str | Input |
| string | $charset | Character set |
_js_link_removal(array $match) : string
JS Link Removal
Callback method for xss_clean() to sanitize links.
This limits the PCRE backtracks, making it more performance friendly and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in PHP 5.2+ on link-heavy strings.
| array | $match |
_js_img_removal(array $match) : string
JS Image Removal
Callback method for xss_clean() to sanitize image tags.
This limits the PCRE backtracks, making it more performance friendly and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in PHP 5.2+ on image tag heavy strings.
| array | $match |