title: Removing control characters from a UTF-8 string in PHP
body: <p>So I am removing control characters (tab, cr, lf, \v and all other invisible chars) in the client side (after input) but since the client cannot be trusted, I have to remove them in the server too.</p>
  
  <p>so according to this link <a href="http://www.utf8-chartable.de/">http://www.utf8-chartable.de/</a></p>
  
  <p>the control characters are from x00 to 1F and from 7F to 9F.
  thus my client (javascript) control char removal function is:</p>
  
  <pre><code>return s.replace(/[\x00-\x1F\x7F-\x9F]/g, "");
  </code></pre>
  
  <p>and my php (server) control char removal function is:</p>
  
  <pre><code>$s = preg_replace('/[\x00-\x1F\x7F-\x9F]/', '', $s);
  </code></pre>
  
  <p>Now this seems to create problems with international utf8 chars such as ς (xCF x82) in PHP only (because x82 is inside the second sequence group), the javascript equivalent does not create any problems.</p>
  
  <p>Now my question is, should I remove the control characters from 7F to 9F? To my understanding those the sequences from 127 to 159 (7F to 9F) obviously can be part of a valid UTF-8 string?</p>
  
  <p>also, maybe I shouldn't even filter the 00 to 31 control characters because also some of those characters can appear in some weird (japanese? chinese?) but valid utf-8 characters ?</p>