3v4l.org

run code in 500+ PHP versions simultaneously
<?php function sanitize_html_class( $class, $fallback = '' ) { //Strip out any % encoded octets $sanitized = preg_replace( '|%[a-fA-F0-9][a-fA-F0-9]|', '', $class ); //Limit to A-Z,a-z,0-9,_,- $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $sanitized ); if ( '' == $sanitized ) $sanitized = $fallback; /** * Filter a sanitized HTML class string. * * @since 2.8.0 * * @param string $sanitized The sanitized HTML class. * @param string $class HTML class before sanitization. * @param string $fallback The fallback string. */ // N/A // return apply_filters( 'sanitize_html_class', $sanitized, $class, $fallback ); return $sanitized; } $class_name = '300"; onload="/* some JavaScript */'; var_dump( '<div class="' . sanitize_html_class( $class_name ) . '"></div>' ); var_dump( '<div class="' . $class_name . '"></div>' );
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/RRqr1
function name:  (null)
number of ops:  15
compiled vars:  !0 = $class_name
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   25     0  E >   ASSIGN                                                       !0, '300%22%3B+onload%3D%22%2F%2A+some+JavaScript+%2A%2F'
   27     1        INIT_FCALL                                                   'var_dump'
          2        INIT_FCALL                                                   'sanitize_html_class'
          3        SEND_VAR                                                     !0
          4        DO_FCALL                                          0  $2      
          5        CONCAT                                               ~3      '%3Cdiv+class%3D%22', $2
          6        CONCAT                                               ~4      ~3, '%22%3E%3C%2Fdiv%3E'
          7        SEND_VAL                                                     ~4
          8        DO_ICALL                                                     
   29     9        INIT_FCALL                                                   'var_dump'
         10        CONCAT                                               ~6      '%3Cdiv+class%3D%22', !0
         11        CONCAT                                               ~7      ~6, '%22%3E%3C%2Fdiv%3E'
         12        SEND_VAL                                                     ~7
         13        DO_ICALL                                                     
         14      > RETURN                                                       1

Function sanitize_html_class:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 10, Position 2 = 11
Branch analysis from position: 10
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 11
filename:       /in/RRqr1
function name:  sanitize_html_class
number of ops:  13
compiled vars:  !0 = $class, !1 = $fallback, !2 = $sanitized
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
    3     0  E >   RECV                                                 !0      
          1        RECV_INIT                                            !1      ''
    5     2        FRAMELESS_ICALL_3                preg_replace        ~3      '%7C%25%5Ba-fA-F0-9%5D%5Ba-fA-F0-9%5D%7C', ''
          3        OP_DATA                                                      !0
          4        ASSIGN                                                       !2, ~3
    8     5        FRAMELESS_ICALL_3                preg_replace        ~5      '%2F%5B%5EA-Za-z0-9_-%5D%2F', ''
          6        OP_DATA                                                      !2
          7        ASSIGN                                                       !2, ~5
   10     8        IS_EQUAL                                                     !2, ''
          9      > JMPZ                                                         ~7, ->11
   11    10    >   ASSIGN                                                       !2, !1
   23    11    > > RETURN                                                       !2
   24    12*     > RETURN                                                       null

End of function sanitize_html_class

Generated using Vulcan Logic Dumper, using php 8.5.0


preferences:
168.82 ms | 1877 KiB | 15 Q