untaint
(PECL taint >=0.1.0)
untaint — Remove the taint mark from strings
Description
Clears the taint mark on the given strings.
The mark is stored on the string itself, not on the variable, so this
clears it for every variable sharing the same string at once. Use it to
whitelist values you have validated yourself, for example after a strict
allow-list check.
Parameters
string-
A variable holding the string to clean.
strings-
Further variables to clean.
Return Values
Always returns true. When
taint.enable is off, the
function does nothing and still returns true.
Examples
Example #1 untaint() example
<?php
$id = "42";
taint($id);
if (preg_match('/^\d+$/', $id)) {
// strictly validated as digits: safe to trust
untaint($id);
}
var_dump(is_tainted($id));
?>
The above example will output
something similar to:
Notes
Note:
Only string values can carry the mark; passing a non-string is a
no-op.
taint
Taint Functions