modX.sanitizeString

modX::sanitizeString¶

Removes HTML tags from a string, deletes a fixed list of characters, then keeps only letters, digits, _, -, ., /, spaces and [. Characters are dropped, never escaped, so the result can go straight into a query or a class key.

Core uses it on request values that end up in SQL or manager logic, such as namespace foreign keys and manager login flags.

Syntax¶

string sanitizeString (string $str, [array $chars = ['/', "'", '"', '(', ')', ';', '>', '<']], [string $allowedTags = ''])

• $str (string) value to sanitize
• $chars (array) characters deleted after tag stripping; the default list is shown in the signature
• $allowedTags (string) tags kept by PHP strip_tags(), by default none are kept

Example¶

$clean = $modx->sanitizeString('<b>foobar</b> (staff)');

// $clean === 'foobar staff'

See Also¶

• modX
• modX.stripTags