TRIM or sanitize_email

I like to know what is a better practice to use TRIM function or sanitize_email.

    $email = trim($_POST['email']); 
    $email = sanitize_email($_POST['email']); 

Need help.

Both.
I would trim first, then validate.
Rather than use a homemade sanitize function, if you use the built in filter_var() with the validate_email filter, any unsanitory value is unlikely to pass validation and may be rejected. So you sanitize and validate at the same time.

You validate data to make sure it meets the ‘business’ needs of your application.

Other than trimming user submitted data, mainly so that you can detect if it is all white-space characters, do NOT modify user submitted data.

You validate a ‘required’ field, by checking if the trimmed value is an empty string or not. If a ‘required’ value is an empty string, you setup a message for the user letting them know that it is required.

For a value that must have a specific format, like an email address, you validate if it does or does not have that format. If it does not, you setup a message for the user letting them know that it does not.

If you use an array to hold user/validation error messages, with the main index being the field name, it is easy to manage dependent validation tests and to test if there are or are not any user/validation errors.

If the data passes all the validation tests (the array holding the user/validation error messages is empty), you use it. If the data was not valid (the array holding the user/validation error messages is not empty), you would display the error message(s) when you redisplay the form, either all at once or individually adjacent to the field they correspond to, repopulate the form field values with the submitted form data, so that the user doesn’t need to keep reentering data over and over, let the user correct the validation problems, and resubmit the form.

‘Sanitize’ implies cleaning or making a value safe to use. The way to secure an application is to use each data value safely in whatever context it is being used in. For a value being used in an sql context, use a prepared query. For a value being used in a html context, apply htmlentities() to it when you output it in the html context.

2 Likes

The sanitize_email() function that the OP indicated is probably from wordpress -

sanitize_email( string $email ): string
Strips out all characters that are not allowable in an email.

More Information
After sanitize_email() has done its work, it passes the sanitized e-mail address through the sanitize_email filter.
This function uses a smaller allowable character set than the set defined by RFC 5322. Some legal email addresses may be changed.
Allowed character regular expression: /[^a-z0-9+_.@-]/i.

I’ll repeat this again. Do NOT modify user submitted data and use it, as this changes the meaning of the data.

In this case, this will remove characters from valid email addresses, rendering them useless. So, someone tries to register on a site, their valid email address gets changed and used, and everything dependent on having the correct email address for them doesn’t work.

Only validate user submitted data. If it is valid, use it. If it is not valid, tell the user and let them correct the problem. If a user has a valid value, such as a name or an email that your validation doesn’t allow, they can notify you (the site owner/administrator/developer) via a ‘contact us’ page about the problem, so that the validation logic can be adjusted.

Can be improved my code?

<?php
//using sanitization function sanitize_text_field()
    
$name = trim($_POST["name"]);
$email = trim($_POST["email"]);
$phone = trim($_POST["phone"]);
$body = trim($_POST["body"]);

$sanitized_name_field = sanitize_text_field( $_POST['name'] );
$sanitized_body_field = sanitize_text_field( $_POST['body'] );

if ( ! empty($name) || ! empty($email) || ! empty($phone) || ! empty($body)) {
     update_option( 'sanitized_name_field', $name );
     $sanitized_numeric_field = (int) $_POST['phone'];
     update_option( 'sanitized_body_field', $body );
}

echo $sanitized_name_field;
echo $email;//do NOT modify user submitted data
echo $sanitized_numeric_field;
echo $sanitized_body_field;

?>

I would put the empty checks immediately after the trims, before you do anything else.
To be a bit less repetetive I would maybe make an array of fields I want to check.

$fields = ['name', 'email', 'phone', 'body'];

You can then put the repeated things like trim and empty checks in a foreach loop.

foreach($fields as $input){
      $trimmed =  trim($_POST[$input]);
      if(empty($trimmed)){ $valErrors[] = "You must fill in the $input field." ;}
}

Here we also see an array of validation errors being built (or not).

Not modyifing doesn’t mean “do nothing”, you still need to validate all user input.

if(!filter_var($email, FILTER_VALIDATE_EMAIL)){
      $valErrors[] = "Please supply a valid email address." ; // or words to that effect
}

Now I’m not sure what those WP functions do to your values, but when printing user input to a page you would generally use htmlentities() to make it safe. Eg:-

echo htmlentities($name);
echo htmlentities($email);

Why are you setting these options? What are you doing with them?

Note that setting them this way the values are NOT user dependent, meaning that if one user fills in something all other users will be able to see it if you read this value for them!!

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.