3v4l.org

run code in 300+ PHP versions simultaneously
<?php function sanitize_html_class( $class, $fallback = '' ) { //Strip out any % encoded octets $sanitized = preg_replace( '|%[a-fA-F0-9][a-fA-F0-9]|', '', $class ); //Limit to A-Z,a-z,0-9,_,- $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $sanitized ); if ( '' == $sanitized ) $sanitized = $fallback; /** * Filter a sanitized HTML class string. * * @since 2.8.0 * * @param string $sanitized The sanitized HTML class. * @param string $class HTML class before sanitization. * @param string $fallback The fallback string. */ // N/A // return apply_filters( 'sanitize_html_class', $sanitized, $class, $fallback ); return $sanitized; } $class_name = '300"; onload="/* some JavaScript */'; var_dump( '<div class="' . sanitize_html_class( $class_name ) . '"></div>' ); var_dump( '<div class="' . $class_name . '"></div>' );
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/RRqr1
function name:  (null)
number of ops:  15
compiled vars:  !0 = $class_name
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   25     0  E >   ASSIGN                                                   !0, '300%22%3B+onload%3D%22%2F%2A+some+JavaScript+%2A%2F'
   27     1        INIT_FCALL                                               'var_dump'
          2        INIT_FCALL                                               'sanitize_html_class'
          3        SEND_VAR                                                 !0
          4        DO_FCALL                                      0  $2      
          5        CONCAT                                           ~3      '%3Cdiv+class%3D%22', $2
          6        CONCAT                                           ~4      ~3, '%22%3E%3C%2Fdiv%3E'
          7        SEND_VAL                                                 ~4
          8        DO_ICALL                                                 
   29     9        INIT_FCALL                                               'var_dump'
         10        CONCAT                                           ~6      '%3Cdiv+class%3D%22', !0
         11        CONCAT                                           ~7      ~6, '%22%3E%3C%2Fdiv%3E'
         12        SEND_VAL                                                 ~7
         13        DO_ICALL                                                 
         14      > RETURN                                                   1

Function sanitize_html_class:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 16, Position 2 = 17
Branch analysis from position: 16
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 17
filename:       /in/RRqr1
function name:  sanitize_html_class
number of ops:  19
compiled vars:  !0 = $class, !1 = $fallback, !2 = $sanitized
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    3     0  E >   RECV                                             !0      
          1        RECV_INIT                                        !1      ''
    5     2        INIT_FCALL                                               'preg_replace'
          3        SEND_VAL                                                 '%7C%25%5Ba-fA-F0-9%5D%5Ba-fA-F0-9%5D%7C'
          4        SEND_VAL                                                 ''
          5        SEND_VAR                                                 !0
          6        DO_ICALL                                         $3      
          7        ASSIGN                                                   !2, $3
    8     8        INIT_FCALL                                               'preg_replace'
          9        SEND_VAL                                                 '%2F%5B%5EA-Za-z0-9_-%5D%2F'
         10        SEND_VAL                                                 ''
         11        SEND_VAR                                                 !2
         12        DO_ICALL                                         $5      
         13        ASSIGN                                                   !2, $5
   10    14        IS_EQUAL                                                 !2, ''
         15      > JMPZ                                                     ~7, ->17
   11    16    >   ASSIGN                                                   !2, !1
   23    17    > > RETURN                                                   !2
   24    18*     > RETURN                                                   null

End of function sanitize_html_class

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
151.3 ms | 1006 KiB | 16 Q