english/libraries/joomla/filter/filterinput.php
/**
	 * Method to be called by another php script. Processes for XSS and
	 * specified bad code.
	 *
	 * @param   mixed   $source	Input string/array-of-string to be 'cleaned'
	 * @param   string  $type	Return type for the variable (INT, UINT, FLOAT, BOOLEAN, WORD, ALNUM, CMD, BASE64, STRING, ARRAY, PATH, NONE)
	 *
	 * @return  mixed  'Cleaned' version of input parameter
	 *
	 * @since   11.1
	 */
Method to be called by another php script. Processes for XSS and
specified bad code.



@return  mixed  'Cleaned' version of input parameter


Method to be called by another php script . Processes for XSS and specified bad code . @return mixed ' Cleaned ' version of input parameter
public function clean($source, $type='string')
	{
		switch (strtoupper($type))
		{
			case 'INT' :
			case 'INTEGER' :
				preg_match('/-?[0-9]+/', (string) $source, $matches);
				$result = @ (int) $matches[0];
				break;
			case 'UINT' :
				preg_match('/-?[0-9]+/', (string) $source, $matches);
				$result = @ abs((int) $matches[0]);
				break;
			case 'FLOAT' :
			case 'DOUBLE' :
				preg_match('/-?[0-9]+(\.[0-9]+)?/', (string) $source, $matches);
				$result = @ (float) $matches[0];
				break;
			case 'BOOL' :
			case 'BOOLEAN' :
				$result = (bool) $source;
				break;
			case 'WORD' :
				$result = (string) preg_replace('/[^A-Z_]/i', '', $source);
				break;
			case 'ALNUM' :
				$result = (string) preg_replace('/[^A-Z0-9]/i', '', $source);
				break;
			case 'CMD' :
				$result = (string) preg_replace('/[^A-Z0-9_\.-]/i', '', $source);
				$result = ltrim($result, '.');
				break;
			case 'BASE64' :
				$result = (string) preg_replace('/[^A-Z0-9\/+=]/i', '', $source);
				break;
			case 'STRING' :
				$result = (string) $this->_remove($this->_decode((string) $source));
				break;
			case 'HTML' :
				$result = (string) $this->_remove((string) $source);
				break;
			case 'ARRAY' :
				$result = (array) $source;
				break;
			case 'PATH' :
				$pattern = '/^[A-Za-z0-9_-]+[A-Za-z0-9_\.-]*([\\\\\/][A-Za-z0-9_-]+[A-Za-z0-9_\.-]*)*$/';
				preg_match($pattern, (string) $source, $matches);
				$result = @ (string) $matches[0];
				break;
			case 'USERNAME' :
				$result = (string) preg_replace('/[\x00-\x1F\x7F<>"\'%&]/', '', $source);
				break;
			case 'TEL' :
				$source = trim($source);
				if (preg_match('/^(?:\+?1[-. ]?)?\(?([2-9][0-8][0-9])\)?[-. ]?([2-9][0-9]{2})[-. ]?([0-9]{4})$/',$source) == 1) {
					$number = (string) preg_replace('/[^\d]/', '', $source);
					if (substr($number,0,1) == 1) {
						$number = substr($number,1);
					}
					if (substr($number,0,2) == '+1') {
						$number = substr($number,2);
					}
					$result = '1.'.$number;
				} elseif
				 (preg_match('/^\+(?:[0-9] ?){6,14}[0-9]$/',$source) == 1) {
					$countrycode =  substr($source,0,strpos($source,' '));
					$countrycode = (string) preg_replace('/[^\d]/', '', $countrycode);
					$number = strstr($source,' ');
					$number = (string) preg_replace('/[^\d]/', '', $number);
					$result = $countrycode.'.'.$number;
				} elseif
				 (preg_match('/^\+[0-9]{1,3}\.[0-9]{4,14}(?:x.+)?$/',$source)  == 1) {
					if (strstr($source,'x')) {
						$xpos = strpos($source,'x');
						$source = substr($source,0,$xpos);
					}
					$countrycode =  strstr($source,'.',true);
					$countrycode = (string) preg_replace('/[^\d]/', '', $countrycode);
					$number = strstr($source,'.');
					$number = (string) preg_replace('/[^\d]/', '', $number);
					$result = $countrycode.'.'.$number;
				} else
				{ $source = (string) preg_replace('/[^\d]/', '', $source);
					if ($source != null) {
						$length = strlen($source);
						if ($length <= 12) {
							$result='.'.$source;
						} else {
							$cclen = $length - 12;
							$result = substr($source,0,$cclen).'.'.substr($source,$cclen);
						}
					}
					 else {
						$result = '.';
					}
				}
				break;
			default :
								if (is_array($source))
				{
					foreach ($source as $key => $value)
					{
						if (is_string($value)) {
							$source[$key] = $this->_remove($this->_decode($value));
						}
					}
					$result = $source;
				}
				else
				{
										if (is_string($source) && !empty ($source)) {
						$result = $this->_remove($this->_decode($source));
					}
					else {
						$result = $source;
					}
				}
				break;
		}
		return $result;
	}
public function clean ( $ source , $ type = 'string' ) { switch ( strtoupper ( $ type ) ) { case 'INT' : case 'INTEGER' : preg_match ( '/-?[0-9]+/' , ( string ) $ source , $ matches ) ; $ result = @ ( int ) $ matches [ 0 ] ; break ; case 'UINT' : preg_match ( '/-?[0-9]+/' , ( string ) $ source , $ matches ) ; $ result = @ abs ( ( int ) $ matches [ 0 ] ) ; break ; case 'FLOAT' : case 'DOUBLE' : preg_match ( '/-?[0-9]+(\.[0-9]+)?/' , ( string ) $ source , $ matches ) ; $ result = @ ( float ) $ matches [ 0 ] ; break ; case 'BOOL' : case 'BOOLEAN' : $ result = ( bool ) $ source ; break ; case 'WORD' : $ result = ( string ) preg_replace ( '/[^A-Z_]/i' , '' , $ source ) ; break ; case 'ALNUM' : $ result = ( string ) preg_replace ( '/[^A-Z0-9]/i' , '' , $ source ) ; break ; case 'CMD' : $ result = ( string ) preg_replace ( '/[^A-Z0-9_\.-]/i' , '' , $ source ) ; $ result = ltrim ( $ result , '.' ) ; break ; case 'BASE64' : $ result = ( string ) preg_replace ( '/[^A-Z0-9\/+=]/i' , '' , $ source ) ; break ; case 'STRING' : $ result = ( string ) $ this -> _remove ( $ this -> _decode ( ( string ) $ source ) ) ; break ; case 'HTML' : $ result = ( string ) $ this -> _remove ( ( string ) $ source ) ; break ; case 'ARRAY' : $ result = ( array ) $ source ; break ; case 'PATH' : $ pattern = '/^[A-Za-z0-9_-]+[A-Za-z0-9_\.-]*([\\\\\/][A-Za-z0-9_-]+[A-Za-z0-9_\.-]*)*$/' ; preg_match ( $ pattern , ( string ) $ source , $ matches ) ; $ result = @ ( string ) $ matches [ 0 ] ; break ; case 'USERNAME' : $ result = ( string ) preg_replace ( '/[\x00-\x1F\x7F<>"\'%&]/' , '' , $ source ) ; break ; case 'TEL' : $ source = trim ( $ source ) ; if ( preg_match ( '/^(?:\+?1[-. ]?)?\(?([2-9][0-8][0-9])\)?[-. ]?([2-9][0-9]{2})[-. ]?([0-9]{4})$/' , $ source ) == 1 ) { $ number = ( string ) preg_replace ( '/[^\d]/' , '' , $ source ) ; if ( substr ( $ number , 0 , 1 ) == 1 ) { $ number = substr ( $ number , 1 ) ; } if ( substr ( $ number , 0 , 2 ) == '+1' ) { $ number = substr ( $ number , 2 ) ; } $ result = '1.' . $ number ; } elseif ( preg_match ( '/^\+(?:[0-9] ?){6,14}[0-9]$/' , $ source ) == 1 ) { $ countrycode = substr ( $ source , 0 , strpos ( $ source , ' ' ) ) ; $ countrycode = ( string ) preg_replace ( '/[^\d]/' , '' , $ countrycode ) ; $ number = strstr ( $ source , ' ' ) ; $ number = ( string ) preg_replace ( '/[^\d]/' , '' , $ number ) ; $ result = $ countrycode . '.' . $ number ; } elseif ( preg_match ( '/^\+[0-9]{1,3}\.[0-9]{4,14}(?:x.+)?$/' , $ source ) == 1 ) { if ( strstr ( $ source , 'x' ) ) { $ xpos = strpos ( $ source , 'x' ) ; $ source = substr ( $ source , 0 , $ xpos ) ; } $ countrycode = strstr ( $ source , '.' , true ) ; $ countrycode = ( string ) preg_replace ( '/[^\d]/' , '' , $ countrycode ) ; $ number = strstr ( $ source , '.' ) ; $ number = ( string ) preg_replace ( '/[^\d]/' , '' , $ number ) ; $ result = $ countrycode . '.' . $ number ; } else { $ source = ( string ) preg_replace ( '/[^\d]/' , '' , $ source ) ; if ( $ source != null ) { $ length = strlen ( $ source ) ; if ( $ length <= 12 ) { $ result = '.' . $ source ; } else { $ cclen = $ length - 12 ; $ result = substr ( $ source , 0 , $ cclen ) . '.' . substr ( $ source , $ cclen ) ; } } else { $ result = '.' ; } } break ; default : if ( is_array ( $ source ) ) { foreach ( $ source as $ key => $ value ) { if ( is_string ( $ value ) ) { $ source [ $ key ] = $ this -> _remove ( $ this -> _decode ( $ value ) ) ; } } $ result = $ source ; } else { if ( is_string ( $ source ) && ! empty ( $ source ) ) { $ result = $ this -> _remove ( $ this -> _decode ( $ source ) ) ; } else { $ result = $ source ; } } break ; } return $ result ; }
Method to be called by another php script.
Method to be called by another php script .
// Handle the type constraint // Only use the first integer value // Only use the first integer value // Only use the first floating point value // Are we dealing with an array?
 // filter element for XSS and other 'bad' code etc. // Or a string?
 // filter source for XSS and other 'bad' code etc. // Not an array or string.. return the passed parameter