フィルタリングとサニタイジング ============================== Sanitizing user input is a critical part of software development. Trusting or neglecting to sanitize user input could lead to unauthorized access to the content of your application, mainly user data, or even the server your application is hosted on. .. figure:: ../_static/img/sql.png :align: center `Full image (from xkcd)`_ The :doc:`Phalcon\\Filter <../api/Phalcon_Filter>` component provides a set of commonly used filters and data sanitizing helpers. It provides object-oriented wrappers around the PHP filter extension. ビルトイン・フィルタの種類 -------------------------- The following are the built-in filters provided by this component: +-----------+---------------------------------------------------------------------------+ | Name | Description | +===========+===========================================================================+ | string | Strip tags and escapes HTML entities, including single and double quotes. | +-----------+---------------------------------------------------------------------------+ | email | Remove all characters except letters, digits and !#$%&*+-/=?^_`{\|}~@.[]. | +-----------+---------------------------------------------------------------------------+ | int | Remove all characters except digits, plus and minus sign. | +-----------+---------------------------------------------------------------------------+ | float | Remove all characters except digits, dot, plus and minus sign. | +-----------+---------------------------------------------------------------------------+ | alphanum | Remove all characters except [a-zA-Z0-9] | +-----------+---------------------------------------------------------------------------+ | striptags | Applies the strip_tags_ function | +-----------+---------------------------------------------------------------------------+ | trim | Applies the trim_ function | +-----------+---------------------------------------------------------------------------+ | lower | Applies the strtolower_ function | +-----------+---------------------------------------------------------------------------+ | upper | Applies the strtoupper_ function | +-----------+---------------------------------------------------------------------------+ データのサニタイズ ------------------ Sanitizing is the process which removes specific characters from a value, that are not required or desired by the user or application. By sanitizing input we ensure that application integrity will be intact. .. code-block:: php sanitize("some(one)@exa\mple.com", "email"); // Returns "hello" $filter->sanitize("hello<<", "string"); // Returns "100019" $filter->sanitize("!100a019", "int"); // Returns "100019.01" $filter->sanitize("!100a019.01a", "float"); コントローラでのサニタイジング ------------------------------ You can access a :doc:`Phalcon\\Filter <../api/Phalcon_Filter>` object from your controllers when accessing GET or POST input data (through the request object). The first parameter is the name of the variable to be obtained; the second is the filter to be applied on it. .. code-block:: php request->getPost("price", "double"); // Sanitizing email from input $email = $this->request->getPost("customerEmail", "email"); } } アクションパラメータのフィルタリング ------------------------------------ The next example shows you how to sanitize the action parameters within a controller action: .. code-block:: php filter->sanitize($productId, "int"); } } データのフィルタリング ---------------------- In addition to sanitizing, :doc:`Phalcon\\Filter <../api/Phalcon_Filter>` also provides filtering by removing or modifying input data to the format we expect. .. code-block:: php sanitize("