-1

I'm studying PHP from w3schools PHP tutorial.

In a chapter about PHP Filters I came across following program :

<!DOCTYPE html>
    <html>
      <body>

      <?php
        $email = "john.doe@example.com";

        // Remove all illegal characters from email
        $email = filter_var($email, FILTER_SANITIZE_EMAIL);

        // Validate e-mail
        if (!filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
          echo("$email is a valid email address");
        } else {
          echo("$email is not a valid email address");
        }
      ?>

  </body>
</html>

w3schools is saying that filter_var() function is used to first remove all illegal characters from the $email variable, then check if it is a valid email address.

Then I tried to set value of variable $email to "john.doe@exampleW#%%%%%.com" and tried to print the value as follows :

<!DOCTYPE html>
<html>
   <body>

   <?php
     $email = "john.doe@exampleW#%%%%%.com";

     // Remove all illegal characters from email
     $email = filter_var($email, FILTER_SANITIZE_EMAIL);
     echo "Echoed Email : ".$email; die;
   ?>

   </body>
 </html>

The output of above program I got is the string "john.doe@exampleW#%%%%%.com" as it is I entered.

My question is why the invalid characters from the given invalid email have not been removed according to w3schools?

PHPLover
  • 1
  • 51
  • 158
  • 311

2 Answers2

1

FILTER_SANITIZE_EMAIL does not remove % characters. From the manual:

Remove all characters except letters, digits and !#$%&'*+-=?^_`{|}~@.[].

There are a lot of characters that are actually legal in e-mail addresses.

Emil Vikström
  • 90,431
  • 16
  • 141
  • 175
  • 1
    Where can I get a list of those characters which are treated as illegal and FILTER_SANITIZE_EMAIL removes them? – PHPLover Dec 28 '16 at 13:51
  • @PHPFan probably any other character than those mentioned above, are considered simply illegal, and is not necessary to have a list. For example, illegal characters are: <>¿→☺█ and some other uncommon/programming language characters. – carloswm85 May 19 '21 at 12:25
0

Because, in your example email is valid,

"FILTER_SANITIZE_EMAIL" will allow "!#$%&'*+-=?^_`{|}~@.[]"

Check exceptions.

Shankar Thiyagaraajan
  • 1,705
  • 4
  • 28
  • 46