Lecteur Markdown

Knowledge Base › BEAMREACTOR_SANITIZER_DOCUMENTATION

Beamreactor Sanitizer Documentation

PHP Sanitizer #

A modern, robust approach to handling PHP's loose typing system. The Sanitizer enforces strict data typing, prevents injection attacks, handles multibyte data properly, and protects against overflow vulnerabilities.

Features

✅ Type Enforcement - Prevents illegal data insertion

✅ Multibyte Safe - Proper UTF-8 handling

✅ Injection Protection - Guards against SQL, XSS, path traversal

✅ Overflow Prevention - Blocks delimiter attacks, NaN, infinity

✅ Static API - Clean, modern interface (since v2.0)

Requirements

  • PHP 7.4+ (PHP 8.x recommended)
  • mbstring extension (for multibyte operations)

Installation

php
use Beamreactor\Sanitizer\Parser;

The Sanitizer is auto-loaded via BeamReactor's PluginAutoloader.

Quick Start

Sanitize Data #

php
use Beamreactor\Sanitizer\Parser;

// Sanitize user input
$cleanEmail = Parser::sanitize($_POST['email'], 'email');
$cleanAge = Parser::sanitize($_POST['age'], 'int');
$cleanName = Parser::sanitize($_POST['name'], 'string', ['maxLength' => 100]);

Validate Data #

php
// Check if data is valid (returns true/false)
if (Parser::check($userInput, 'uuid')) {
	// Valid UUID
} else {
	// Invalid format
}

Available Datatypes

Numeric Types #

Arithmetic #

Evaluates mathematical expressions in text fields (e.g., "2+2" → 4).

php
$result = Parser::sanitize('10 + 5 * 2', 'arithmetic');
// Returns: 20

Int #

Integer values only.

php
$age = Parser::sanitize('25.7', 'int');
// Returns: 25

$negative = Parser::sanitize('-100', 'int');
// Returns: -100

Float #

Floating-point numbers.

php
$price = Parser::sanitize('19.99', 'float');
// Returns: 19.99

$scientific = Parser::sanitize('1.5e3', 'float');
// Returns: 1500.0

String Types #

String #

General text with sanitization.

php
$text = Parser::sanitize('<script>alert("xss")</script>', 'string');
// Returns: sanitized string (no HTML)

$limited = Parser::sanitize('Very long text...', 'string', ['maxLength' => 50]);
// Returns: truncated to 50 chars

Name #

Human names (letters, spaces, hyphens, apostrophes).

php
$name = Parser::sanitize("Jean-François O'Brien", 'name');
// Returns: "Jean-François O'Brien"

$invalid = Parser::sanitize("John123", 'name');
// Returns: "John" (numbers stripped)

Html #

HTML content (preserves safe tags).

php
$content = Parser::sanitize('<p>Hello <b>world</b></p>', 'html');
// Returns: allowed tags preserved, dangerous ones stripped

Xml #

XML-safe content.

php
$xml = Parser::sanitize('<tag attr="value">Text & symbols</tag>', 'xml');
// Returns: properly escaped XML

Network Types #

Email #

Email addresses.

php
$email = Parser::sanitize('  USER@EXAMPLE.COM  ', 'email');
// Returns: "user@example.com" (trimmed, lowercased)

if (Parser::check($email, 'email')) {
	// Valid email format
}

Url #

URLs and URIs.

php
$url = Parser::sanitize('https://example.com/path?query=value', 'url');
// Returns: validated URL

$cleaned = Parser::sanitize('javascript:alert(1)', 'url');
// Returns: false (dangerous protocol)

Ip #

IPv4 and IPv6 addresses.

php
$ip = Parser::sanitize('192.168.1.1', 'ip');
// Returns: "192.168.1.1"

$ipv6 = Parser::sanitize('2001:0db8::1', 'ip');
// Returns: valid IPv6

File System Types #

Path #

File paths (prevents directory traversal).

php
$path = Parser::sanitize('uploads/file.jpg', 'path');
// Returns: "uploads/file.jpg"

$malicious = Parser::sanitize('../../../etc/passwd', 'path');
// Returns: false (traversal blocked)

Specialized Types #

Date #

Date and datetime values.

php
$date = Parser::sanitize('2025.12.29', 'date');
// Returns: validated date

$datetime = Parser::sanitize('2025.12.29 14:30:00', 'date');
// Returns: valid datetime

Bool #

Boolean values.

php
$bool = Parser::sanitize('true', 'bool');
// Returns: true

$zero = Parser::sanitize('0', 'bool');
// Returns: false

Uuid #

Universally Unique Identifiers (v4).

php
$uuid = Parser::sanitize('550e8400-e29b-41d4-a716-446655440000', 'uuid');
// Returns: valid UUID

if (Parser::check($input, 'uuid')) {
	// Valid UUID format
}

Ldapuser #

LDAP usernames.

php
$ldap = Parser::sanitize('john.doe', 'ldapuser');
// Returns: LDAP-safe username

Phpsession #

PHP session IDs.

php
$session = Parser::sanitize($_COOKIE['PHPSESSID'], 'phpsession');
// Returns: validated session ID

Special Types #

Null #

Ensures null values.

php
$null = Parser::sanitize('', 'null');
// Returns: null

$nonNull = Parser::sanitize('value', 'null');
// Returns: false

Encoding #

Validates UTF-8 encoding.

php
$text = Parser::sanitize($input, 'encoding');
// Returns: UTF-8 validated text

Dummy #

Pass-through type (for custom validation).

php
$raw = Parser::sanitize($data, 'dummy');
// Returns: data as-is (no sanitization)

Advanced Usage

Options Array #

Most datatypes accept an options array as the third parameter:

php
Parser::sanitize($input, $type, $options);

Common options:

  • maxLength - Maximum string length
  • minLength - Minimum string length
  • allowedChars - Whitelist of characters
  • encoding - Character encoding (default: UTF-8)

Examples:

php
// Limit string length
$username = Parser::sanitize($input, 'string', ['maxLength' => 50]);

// Minimum length enforcement
$password = Parser::sanitize($input, 'string', ['minLength' => 8]);

// Custom character whitelist
$code = Parser::sanitize($input, 'string', ['allowedChars' => 'A-Z0-9']);

Empty Array Trick #

Pass an empty array to sanitize without encoding:

php
// Sanitize but don't HTML-encode
$text = Parser::sanitize($message, 'string', []);

Security Best Practices

Input Validation #

php
// ALWAYS sanitize user input
$userId = Parser::sanitize($_GET['id'], 'int');
$email = Parser::sanitize($_POST['email'], 'email');
$file = Parser::sanitize($_FILES['upload']['name'], 'path');

Database Queries #

php
// Use with BeamReactor SQL class
use Beamreactor\Database\SQL;

$name = Parser::sanitize($_POST['name'], 'string', ['maxLength' => 100]);
$age = Parser::sanitize($_POST['age'], 'int');

SQL::query(
	"INSERT INTO users (name, age) VALUES (?, ?)",
	[$name, $age],
	['string', 'int']
);

XSS Prevention #

php
// User-generated content
$comment = Parser::sanitize($_POST['comment'], 'html');

// Display safely
echo $comment; // Dangerous tags stripped

Path Traversal Protection #

php
// File uploads
$filename = Parser::sanitize($_FILES['file']['name'], 'path');

if ($filename) {
	move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $filename);
}

Error Handling

Both sanitize() and check() return false on validation failure:

php
$result = Parser::sanitize($input, 'email');

if ($result === false) {
	// Invalid email format
	throw new Exception('Invalid email address');
}

Type-safe checking:

php
if (!Parser::check($_POST['uuid'], 'uuid')) {
	http_response_code(400);
	die('Invalid UUID format');
}

Migration from v1.x

Old (instance-based):

php
$parser = new Sanitizer\Parser();
$clean = $parser->sanitize($data, 'string');

New (static):

php
use Beamreactor\Sanitizer\Parser;
$clean = Parser::sanitize($data, 'string');

Performance Notes

  • Type detection is case-sensitive - Use exact casing (e.g., Int not int)
  • Multibyte operations - Properly handles UTF-8, emoji, accented characters
  • Minimal overhead - Optimized for high-throughput applications

Credits

Author: Treveur Bretaudière

Organization: BeamReactor

License: Proprietary (BeamReactor CMS)

Version: 2.1.0 (Static API)

← Tous les fichiers