4 * Function library for anything related to formatting / validating / sanitizing
8 * Convert an integer (1337) to a string (3jk).
11 function yourls_int2string( $num, $chars = null ) {
13 $chars = yourls_get_shorturl_charset();
15 $len = strlen( $chars );
16 while( $num >= $len ) {
17 $mod = bcmod( $num, $len );
18 $num = bcdiv( $num, $len );
19 $string = $chars[ $mod ] . $string;
21 $string = $chars[ intval( $num ) ] . $string;
23 return yourls_apply_filter( 'int2string', $string, $num, $chars );
27 * Convert a string (3jk) to an integer (1337)
30 function yourls_string2int( $string, $chars = null ) {
32 $chars = yourls_get_shorturl_charset();
34 $string = strrev( $string );
35 $baselen = strlen( $chars );
36 $inputlen = strlen( $string );
37 for ($i = 0; $i < $inputlen; $i++) {
38 $index = strpos( $chars, $string[$i] );
39 $integer = bcadd( $integer, bcmul( $index, bcpow( $baselen, $i ) ) );
42 return yourls_apply_filter( 'string2int', $integer, $string, $chars );
46 * Return a unique(ish) hash for a string to be used as a valid HTML id
49 function yourls_string2htmlid( $string ) {
50 return yourls_apply_filter( 'string2htmlid', 'y'.abs( crc32( $string ) ) );
54 * Make sure a link keyword (ie "1fv" as in "http://sho.rt/1fv") is valid.
57 function yourls_sanitize_string( $string ) {
58 // make a regexp pattern with the shorturl charset, and remove everything but this
59 $pattern = yourls_make_regexp_pattern( yourls_get_shorturl_charset() );
60 $valid = substr( preg_replace( '![^'.$pattern.']!', '', $string ), 0, 199 );
62 return yourls_apply_filter( 'sanitize_string', $valid, $string );
66 * Alias function. I was always getting it wrong.
69 function yourls_sanitize_keyword( $keyword ) {
70 return yourls_sanitize_string( $keyword );
74 * Sanitize a page title. No HTML per W3C http://www.w3.org/TR/html401/struct/global.html#h-7.4.2
78 * @param string $unsafe_title Title, potentially unsafe
79 * @param string $fallback Optional fallback if after sanitization nothing remains
80 * @return string Safe title
82 function yourls_sanitize_title( $unsafe_title, $fallback = '' ) {
83 $title = $unsafe_title;
84 $title = strip_tags( $title );
85 $title = preg_replace( "/\s+/", ' ', trim( $title ) );
87 if ( '' === $title || false === $title ) {
91 return yourls_apply_filter( 'sanitize_title', $title, $unsafe_title, $fallback );
95 * A few sanity checks on the URL. Used for redirection or DB. For display purpose, see yourls_esc_url()
97 * @param string $unsafe_url unsafe URL
98 * @param array $protocols Optional allowed protocols, default to global $yourls_allowedprotocols
99 * @return string Safe URL
101 function yourls_sanitize_url( $unsafe_url, $protocols = array() ) {
102 $url = yourls_esc_url( $unsafe_url, 'redirection', $protocols );
103 return yourls_apply_filter( 'sanitize_url', $url, $unsafe_url );
107 * Perform a replacement while a string is found, eg $subject = '%0%0%0DDD', $search ='%0D' -> $result =''
109 * Stolen from WP's _deep_replace
112 function yourls_deep_replace( $search, $subject ){
116 foreach( (array) $search as $val ) {
117 while( strpos( $subject, $val ) !== false ) {
119 $subject = str_replace( $val, '', $subject );
128 * Make sure an integer is a valid integer (PHP's intval() limits to too small numbers)
131 function yourls_sanitize_int( $in ) {
132 return ( substr( preg_replace( '/[^0-9]/', '', strval( $in ) ), 0, 20 ) );
136 * Escape a string or an array of strings before DB usage. ALWAYS escape before using in a SQL query. Thanks.
138 * @param string|array $data string or array of strings to be escaped
139 * @return string|array escaped data
141 function yourls_escape( $data ) {
142 if( is_array( $data ) ) {
143 foreach( $data as $k => $v ) {
144 if( is_array( $v ) ) {
145 $data[ $k ] = yourls_escape( $v );
147 $data[ $k ] = yourls_escape_real( $v );
151 $data = yourls_escape_real( $data );
158 * "Real" escape. This function should NOT be called directly. Use yourls_escape() instead.
160 * This function uses a "real" escape if possible, using PDO, MySQL or MySQLi functions,
161 * with a fallback to a "simple" addslashes
162 * If you're implementing a custom DB engine or a custom cache system, you can define an
163 * escape function using filter 'custom_escape_real'
166 * @param string $a string to be escaped
167 * @return string escaped string
169 function yourls_escape_real( $string ) {
171 if( isset( $ydb ) && ( $ydb instanceof ezSQLcore ) )
172 return $ydb->escape( $string );
174 // YOURLS DB classes have been bypassed by a custom DB engine or a custom cache layer
175 return yourls_apply_filter( 'custom_escape_real', addslashes( $string ), $string );
179 * Sanitize an IP address
182 function yourls_sanitize_ip( $ip ) {
183 return preg_replace( '/[^0-9a-fA-F:., ]/', '', $ip );
187 * Make sure a date is m(m)/d(d)/yyyy, return false otherwise
190 function yourls_sanitize_date( $date ) {
191 if( !preg_match( '!^\d{1,2}/\d{1,2}/\d{4}$!' , $date ) ) {
198 * Sanitize a date for SQL search. Return false if malformed input.
201 function yourls_sanitize_date_for_sql( $date ) {
202 if( !yourls_sanitize_date( $date ) )
204 return date( 'Y-m-d', strtotime( $date ) );
208 * Return trimmed string
211 function yourls_trim_long_string( $string, $length = 60, $append = '[...]' ) {
212 $newstring = $string;
213 if ( mb_strlen( $newstring ) > $length ) {
214 $newstring = mb_substr( $newstring, 0, $length - mb_strlen( $append ), 'UTF-8' ) . $append;
216 return yourls_apply_filter( 'trim_long_string', $newstring, $string, $length, $append );
220 * Sanitize a version number (1.4.1-whatever-RC1 -> 1.4.1)
223 * @param string $ver Version number
224 * @return string Sanitized version number
226 function yourls_sanitize_version( $ver ) {
227 preg_match( '/(^[0-9.]+).*$/', $ver, $matches );
228 return isset( $matches[1] ) ? trim( $matches[1], '.' ) : '';
232 * Sanitize a filename (no Win32 stuff)
235 function yourls_sanitize_filename( $file ) {
236 $file = str_replace( '\\', '/', $file ); // sanitize for Win32 installs
237 $file = preg_replace( '|/+|' ,'/', $file ); // remove any duplicate slash
242 * Check if a string seems to be UTF-8. Stolen from WP.
245 function yourls_seems_utf8( $str ) {
246 $length = strlen( $str );
247 for ( $i=0; $i < $length; $i++ ) {
248 $c = ord( $str[ $i ] );
249 if ( $c < 0x80 ) $n = 0; # 0bbbbbbb
250 elseif (($c & 0xE0) == 0xC0) $n=1; # 110bbbbb
251 elseif (($c & 0xF0) == 0xE0) $n=2; # 1110bbbb
252 elseif (($c & 0xF8) == 0xF0) $n=3; # 11110bbb
253 elseif (($c & 0xFC) == 0xF8) $n=4; # 111110bb
254 elseif (($c & 0xFE) == 0xFC) $n=5; # 1111110b
255 else return false; # Does not match any model
256 for ($j=0; $j<$n; $j++) { # n bytes matching 10bbbbbb follow ?
257 if ((++$i == $length) || ((ord($str[$i]) & 0xC0) != 0x80))
266 * Check for PCRE /u modifier support. Stolen from WP.
268 * Just in case "PCRE is not compiled with PCRE_UTF8" which seems to happen
269 * on some distros even for PHP 5.3
273 * @return bool whether there's /u support or not
275 function yourls_supports_pcre_u() {
277 if( !isset( $utf8_pcre ) ) {
278 $utf8_pcre = (bool) @preg_match( '/^./u', 'a' );
284 * Checks for invalid UTF8 in a string. Stolen from WP
288 * @param string $string The text which is to be checked.
289 * @param boolean $strip Optional. Whether to attempt to strip out invalid UTF8. Default is false.
290 * @return string The checked text.
292 function yourls_check_invalid_utf8( $string, $strip = false ) {
293 $string = (string) $string;
295 if ( 0 === strlen( $string ) ) {
299 // We can't demand utf8 in the PCRE installation, so just return the string in those cases
300 if ( ! yourls_supports_pcre_u() ) {
304 // preg_match fails when it encounters invalid UTF8 in $string
305 if ( 1 === @preg_match( '/^./us', $string ) ) {
309 // Attempt to strip the bad chars if requested (not recommended)
310 if ( $strip && function_exists( 'iconv' ) ) {
311 return iconv( 'utf-8', 'utf-8', $string );
318 * Converts a number of special characters into their HTML entities. Stolen from WP.
320 * Specifically deals with: &, <, >, ", and '.
322 * $quote_style can be set to ENT_COMPAT to encode " to
323 * ", or ENT_QUOTES to do both. Default is ENT_NOQUOTES where no quotes are encoded.
327 * @param string $string The text which is to be encoded.
328 * @param mixed $quote_style Optional. Converts double quotes if set to ENT_COMPAT, both single and double if set to ENT_QUOTES or none if set to ENT_NOQUOTES. Also compatible with old values; converting single quotes if set to 'single', double if set to 'double' or both if otherwise set. Default is ENT_NOQUOTES.
329 * @param boolean $double_encode Optional. Whether to encode existing html entities. Default is false.
330 * @return string The encoded text with HTML entities.
332 function yourls_specialchars( $string, $quote_style = ENT_NOQUOTES, $double_encode = false ) {
333 $string = (string) $string;
335 if ( 0 === strlen( $string ) )
338 // Don't bother if there are no specialchars - saves some processing
339 if ( ! preg_match( '/[&<>"\']/', $string ) )
342 // Account for the previous behaviour of the function when the $quote_style is not an accepted value
343 if ( empty( $quote_style ) )
344 $quote_style = ENT_NOQUOTES;
345 elseif ( ! in_array( $quote_style, array( 0, 2, 3, 'single', 'double' ), true ) )
346 $quote_style = ENT_QUOTES;
350 $_quote_style = $quote_style;
352 if ( $quote_style === 'double' ) {
353 $quote_style = ENT_COMPAT;
354 $_quote_style = ENT_COMPAT;
355 } elseif ( $quote_style === 'single' ) {
356 $quote_style = ENT_NOQUOTES;
359 // Handle double encoding ourselves
360 if ( $double_encode ) {
361 $string = @htmlspecialchars( $string, $quote_style, $charset );
363 // Decode & into &
364 $string = yourls_specialchars_decode( $string, $_quote_style );
366 // Guarantee every &entity; is valid or re-encode the &
367 $string = yourls_kses_normalize_entities( $string );
369 // Now re-encode everything except &entity;
370 $string = preg_split( '/(&#?x?[0-9a-z]+;)/i', $string, -1, PREG_SPLIT_DELIM_CAPTURE );
372 for ( $i = 0; $i < count( $string ); $i += 2 )
373 $string[$i] = @htmlspecialchars( $string[$i], $quote_style, $charset );
375 $string = implode( '', $string );
378 // Backwards compatibility
379 if ( 'single' === $_quote_style )
380 $string = str_replace( "'", ''', $string );
386 * Converts a number of HTML entities into their special characters. Stolen from WP.
388 * Specifically deals with: &, <, >, ", and '.
390 * $quote_style can be set to ENT_COMPAT to decode " entities,
391 * or ENT_QUOTES to do both " and '. Default is ENT_NOQUOTES where no quotes are decoded.
395 * @param string $string The text which is to be decoded.
396 * @param mixed $quote_style Optional. Converts double quotes if set to ENT_COMPAT, both single and double if set to ENT_QUOTES or none if set to ENT_NOQUOTES. Also compatible with old _wp_specialchars() values; converting single quotes if set to 'single', double if set to 'double' or both if otherwise set. Default is ENT_NOQUOTES.
397 * @return string The decoded text without HTML entities.
399 function yourls_specialchars_decode( $string, $quote_style = ENT_NOQUOTES ) {
400 $string = (string) $string;
402 if ( 0 === strlen( $string ) ) {
406 // Don't bother if there are no entities - saves a lot of processing
407 if ( strpos( $string, '&' ) === false ) {
411 // Match the previous behaviour of _wp_specialchars() when the $quote_style is not an accepted value
412 if ( empty( $quote_style ) ) {
413 $quote_style = ENT_NOQUOTES;
414 } elseif ( !in_array( $quote_style, array( 0, 2, 3, 'single', 'double' ), true ) ) {
415 $quote_style = ENT_QUOTES;
418 // More complete than get_html_translation_table( HTML_SPECIALCHARS )
419 $single = array( ''' => '\'', ''' => '\'' );
420 $single_preg = array( '/�*39;/' => ''', '/�*27;/i' => ''' );
421 $double = array( '"' => '"', '"' => '"', '"' => '"' );
422 $double_preg = array( '/�*34;/' => '"', '/�*22;/i' => '"' );
423 $others = array( '<' => '<', '<' => '<', '>' => '>', '>' => '>', '&' => '&', '&' => '&', '&' => '&' );
424 $others_preg = array( '/�*60;/' => '<', '/�*62;/' => '>', '/�*38;/' => '&', '/�*26;/i' => '&' );
426 if ( $quote_style === ENT_QUOTES ) {
427 $translation = array_merge( $single, $double, $others );
428 $translation_preg = array_merge( $single_preg, $double_preg, $others_preg );
429 } elseif ( $quote_style === ENT_COMPAT || $quote_style === 'double' ) {
430 $translation = array_merge( $double, $others );
431 $translation_preg = array_merge( $double_preg, $others_preg );
432 } elseif ( $quote_style === 'single' ) {
433 $translation = array_merge( $single, $others );
434 $translation_preg = array_merge( $single_preg, $others_preg );
435 } elseif ( $quote_style === ENT_NOQUOTES ) {
436 $translation = $others;
437 $translation_preg = $others_preg;
440 // Remove zero padding on numeric entities
441 $string = preg_replace( array_keys( $translation_preg ), array_values( $translation_preg ), $string );
443 // Replace characters according to translation table
444 return strtr( $string, $translation );
449 * Escaping for HTML blocks. Stolen from WP
453 * @param string $text
456 function yourls_esc_html( $text ) {
457 $safe_text = yourls_check_invalid_utf8( $text );
458 $safe_text = yourls_specialchars( $safe_text, ENT_QUOTES );
459 return yourls_apply_filter( 'esc_html', $safe_text, $text );
463 * Escaping for HTML attributes. Stolen from WP
467 * @param string $text
470 function yourls_esc_attr( $text ) {
471 $safe_text = yourls_check_invalid_utf8( $text );
472 $safe_text = yourls_specialchars( $safe_text, ENT_QUOTES );
473 return yourls_apply_filter( 'esc_attr', $safe_text, $text );
477 * Checks and cleans a URL before printing it. Stolen from WP.
479 * A number of characters are removed from the URL. If the URL is for displaying
480 * (the default behaviour) ampersands are also replaced.
484 * @param string $url The URL to be cleaned.
485 * @param string $context 'display' or something else. Use yourls_sanitize_url() for database or redirection usage.
486 * @param array $protocols Optional. Array of allowed protocols, defaults to global $yourls_allowedprotocols
487 * @return string The cleaned $url
489 function yourls_esc_url( $url, $context = 'display', $protocols = array() ) {
490 // trim first -- see #1931
493 // make sure there's only one 'http://' at the beginning (prevents pasting a URL right after the default 'http://')
495 array( 'http://http://', 'http://https://' ),
496 array( 'http://', 'https://' ),
503 // make sure there's a protocol, add http:// if not
504 if ( ! yourls_get_protocol( $url ) )
505 $url = 'http://'.$url;
507 $original_url = $url;
509 // force scheme and domain to lowercase - see issues 591 and 1630
510 $url = yourls_lowercase_scheme_domain( $url );
512 $url = preg_replace( '|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\x80-\\xff]|i', '', $url );
513 // Previous regexp in YOURLS was '|[^a-z0-9-~+_.?\[\]\^#=!&;,/:%@$\|*`\'<>"()\\x80-\\xff\{\}]|i'
514 // TODO: check if that was it too destructive
515 $strip = array( '%0d', '%0a', '%0D', '%0A' );
516 $url = yourls_deep_replace( $strip, $url );
518 // Replace ampersands and single quotes only when displaying.
519 if ( 'display' == $context ) {
520 $url = yourls_kses_normalize_entities( $url );
521 $url = str_replace( '&', '&', $url );
522 $url = str_replace( "'", ''', $url );
525 if ( ! is_array( $protocols ) or ! $protocols ) {
526 global $yourls_allowedprotocols;
527 $protocols = yourls_apply_filter( 'esc_url_protocols', $yourls_allowedprotocols );
528 // Note: $yourls_allowedprotocols is also globally filterable in functions-kses.php/yourls_kses_init()
531 if ( !yourls_is_allowed_protocol( $url, $protocols ) )
534 // I didn't use KSES function kses_bad_protocol() because it doesn't work the way I liked (returns //blah from illegal://blah)
536 return yourls_apply_filter( 'esc_url', $url, $original_url, $context );
541 * Lowercase scheme and domain of an URI - see issues 591, 1630, 1889
543 * This function is trickier than what seems to be needed at first
545 * First, we need to handle several URI types: http://example.com, mailto:ozh@ozh.ozh, facetime:user@example.com, and so on, see
546 * yourls_kses_allowed_protocols() in functions-kses.php
547 * The general rule is that the scheme ("stuff://" or "stuff:") is case insensitive and should be lowercase. But then, depending on the
548 * scheme, parts of what follows the scheme may or may not be case sensitive.
550 * Second, simply using parse_url() and its opposite http_build_url() (see functions-compat.php) is a pretty unsafe process:
551 * - parse_url() can easily trip up on malformed or weird URLs
552 * - exploding a URL with parse_url(), lowercasing some stuff, and glueing things back with http_build_url() does not handle well
553 * "stuff:"-like URI [1] and can result in URLs ending modified [2][3]. We don't want to *validate* URI, we just want to lowercase
554 * what is supposed to be lowercased.
556 * So, to be conservative, this functions:
557 * - lowercases the scheme
558 * - does not lowercase anything else on "stuff:" URI
559 * - tries to lowercase only scheme and domain of "stuff://" URI
561 * [1] http_build_url(parse_url("mailto:ozh")) == "mailto:///ozh"
562 * [2] http_build_url(parse_url("http://blah#omg")) == "http://blah/#omg"
563 * [3] http_build_url(parse_url("http://blah?#")) == "http://blah/"
566 * @param string $url URL
567 * @return string URL with lowercase scheme and protocol
569 function yourls_lowercase_scheme_domain( $url ) {
570 $scheme = yourls_get_protocol( $url );
572 if( '' == $scheme ) {
573 // Scheme not found, malformed URL? Something else? Not sure.
577 // Case 1 : scheme like "stuff://" (eg "http://example.com/" or "ssh://joe@joe.com")
578 if( substr( $scheme, -2, 2 ) == '//' ) {
580 $parts = parse_url( $url );
582 // Most likely malformed stuff, could not parse : we'll just lowercase the scheme and leave the rest untouched
583 if( false == $parts ) {
584 $url = str_replace( $scheme, strtolower( $scheme ), $url );
586 // URL seems parsable, let's do the best we can
591 $lower['scheme'] = strtolower( $parts['scheme'] );
593 if( isset( $parts['host'] ) ) {
594 $lower['host'] = strtolower( $parts['host'] );
596 $parts['host'] = '***';
599 // We're not going to glue back things that could be modified in the process
600 unset( $parts['path'] );
601 unset( $parts['query'] );
602 unset( $parts['fragment'] );
604 // original beginning of the URL and its lowercase-where-needed counterpart
605 // We trim the / after the domain to avoid avoid "http://example.com" being reconstructed as "http://example.com/"
606 $partial_original_url = trim( http_build_url( $parts ), '/' );
607 $partial_lower_original_url = trim( http_build_url( $parts, $lower ), '/' );
609 $url = str_replace( $partial_original_url , $partial_lower_original_url, $url );
613 // Case 2 : scheme like "stuff:" (eg "mailto:joe@joe.com" or "bitcoin:15p1o8vnWqNkJBJGgwafNgR1GCCd6EGtQR?amount=1&label=Ozh")
614 // In this case, we only lowercase the scheme, because depending on it, things after should or should not be lowercased
617 $url = str_replace( $scheme, strtolower( $scheme ), $url );
626 * Escape single quotes, htmlspecialchar " < > &, and fix line endings. Stolen from WP.
628 * Escapes text strings for echoing in JS. It is intended to be used for inline JS
629 * (in a tag attribute, for example onclick="..."). Note that the strings have to
630 * be in single quotes. The filter 'js_escape' is also applied here.
634 * @param string $text The text to be escaped.
635 * @return string Escaped text.
637 function yourls_esc_js( $text ) {
638 $safe_text = yourls_check_invalid_utf8( $text );
639 $safe_text = yourls_specialchars( $safe_text, ENT_COMPAT );
640 $safe_text = preg_replace( '/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes( $safe_text ) );
641 $safe_text = str_replace( "\r", '', $safe_text );
642 $safe_text = str_replace( "\n", '\\n', addslashes( $safe_text ) );
643 return yourls_apply_filter( 'esc_js', $safe_text, $text );
647 * Escaping for textarea values. Stolen from WP.
651 * @param string $text
654 function yourls_esc_textarea( $text ) {
655 $safe_text = htmlspecialchars( $text, ENT_QUOTES );
656 return yourls_apply_filter( 'esc_textarea', $safe_text, $text );
661 * PHP emulation of JS's encodeURI
663 * @link https://developer.mozilla.org/en/JavaScript/Reference/Global_Objects/encodeURI
667 function yourls_encodeURI( $url ) {
668 // Decode URL all the way
669 $result = yourls_rawurldecode_while_encoded( $url );
671 $result = strtr( rawurlencode( $result ), array (
672 '%3B' => ';', '%2C' => ',', '%2F' => '/', '%3F' => '?', '%3A' => ':', '%40' => '@',
673 '%26' => '&', '%3D' => '=', '%2B' => '+', '%24' => '$', '%21' => '!', '%2A' => '*',
674 '%27' => '\'', '%28' => '(', '%29' => ')', '%23' => '#',
677 // Known limit: this will most likely break IDN URLs such as http://www.académie-française.fr/
678 // To fully support IDN URLs, advocate use of a plugin.
679 return yourls_apply_filter( 'encodeURI', $result, $url );
683 * Adds backslashes before letters and before a number at the start of a string. Stolen from WP.
687 * @param string $string Value to which backslashes will be added.
688 * @return string String with backslashes inserted.
690 function yourls_backslashit($string) {
691 $string = preg_replace('/^([0-9])/', '\\\\\\\\\1', $string);
692 $string = preg_replace('/([a-z])/i', '\\\\\1', $string);
697 * Check if a string seems to be urlencoded
699 * We use rawurlencode instead of urlencode to avoid messing with '+'
702 * @param string $string
705 function yourls_is_rawurlencoded( $string ) {
706 return rawurldecode( $string ) != $string;
710 * rawurldecode a string till it's not encoded anymore
712 * Deals with multiple encoding (eg "%2521" => "%21" => "!").
713 * See https://github.com/YOURLS/YOURLS/issues/1303
716 * @param string $string
719 function yourls_rawurldecode_while_encoded( $string ) {
720 $string = rawurldecode( $string );
721 if( yourls_is_rawurlencoded( $string ) ) {
722 $string = yourls_rawurldecode_while_encoded( $string );
728 * Converts readable Javascript code into a valid bookmarklet link
730 * Uses https://github.com/ozh/bookmarkletgen
733 * @param string $code Javascript code
734 * @return string Bookmarklet link
736 function yourls_make_bookmarklet( $code ) {
737 if ( !class_exists( 'BookmarkletGen', false ) ) {
738 require_once YOURLS_INC . '/BookmarkletGen/BookmarkletGen.php';
741 $book = new BookmarkletGen;
742 return $book->crunch( $code );