arondeparon / laravel-request-sanitizer Goto Github PK

An easy to use request sanitizer that allows you to sanitize your form data before validating it.

License: MIT License

PHP 100.00%

laravel-request-sanitizer's Introduction

Laravel Request Sanitizer

The arondeparon/laravel-request-sanitizer package provides a fluent interface to sanitize form requests before validating them.

Why should I use this package?

Often, validating your request is not enough. The request sanitizer allows you to easily manipulate your form data before passing it to the validator. You can start using it in a matter of minutes and it is fully compatible with Laravel's FormRequest object.

How to use
Installing
Usage
Predefined Sanitizers
- FilterVars usage
Writing your own Sanitizer
Testing
Credits
License

How to use

Syntax is similar to the way rules are added to a Form Request.

class StoreCustomerInformationRequest extends FormRequest
{
     use SanitizesInputs;
     
     protected $sanitizers = [
        'lastname' => [
            Capitalize::class,
        ],
        'mobile_phone' => [
            RemoveNonNumeric::class
        ],
     ];
}

Installing

composer require arondeparon/laravel-request-sanitizer

Usage

Add the SanitizesInputs trait to your form request.
Write your own sanitizers or use one of the supplied sanitizers and add them to the $sanitizers property of your form request.
Your request data will now be sanitized before being validated.

Predefined Sanitizers

Trim - simple PHP trim() implementation
TrimDuplicateSpaces replaces duplicate spaces with a single space.
RemoveNonNumeric - removes any non numeric character
Capitalize - capitalizes the first character of a string
Uppercase - converts a string to uppercase
Lowercase - converts a string to lowercase
FilterVars - simple PHP filter_var sanitizer
CarbonDate - cast a string to a Carbon object
Contributions are appreciated!

FilterVars usage

The FilterVars sanitizer acts as a wrapper of the default PHP filter_var function. It accepts the same (optional) parameters as the original function. Both parameters can be either an array or string type:

 {
    protected $sanitizers = [
        'last_name' => [
            FilterVars::class => [
                'filter' => FILTER_SANITIZE_STRING,
                'options' => FILTER_FLAG_STRIP_BACKTICK
            ]
        ]
    ];
 }

For more information on filter_vars please refer to https://www.php.net/manual/en/function.filter-var.php.

Writing your own Sanitizer

Writing your own sanitizer can be done by implementing the Sanitizer interface, which requires only one method.

interface Sanitizer
 {
     public function sanitize($input);
 }

Testing

$ composer test

Credits

License

The MIT License (MIT). Please see License File for more information.

laravel-request-sanitizer's People

Contributors

Stargazers

Watchers

Forkers

theodory gitmiro johnpaulmedina erickmcarvalho jaulz rjvandoesburg yekta-kalantary

laravel-request-sanitizer's Issues

Laravel 6 support

Support for Laravel 6. Upgrading form Laravel 5.8 to ^6 should be simple. likely only updating the dependency version constraints.

Thanks

Add suport to JSON fields

Is not possible handler JSON fields with dot notation, for exemple:

protected $sanitizers = [
        'cpf' => [
            RemoveNonNumeric::class,
        ],
        'store.cnpj' => [
            RemoveNonNumeric::class,
        ],
    ];

Laravel 9 support

Dropping this here.

The package currently supports Laravel versions up to 8. Some work is needed to make it L9 compatible.

Acceptance criteria:

Check whether L9 has any new functionality that might be useful to incorporate into the package
Tests should all pass, of course
Github builds should pass

I don't have a lot of free time to work on this package, so if you feel like doing this, it would be greatly appreciated! If not... Laravel 9 will be supported, sooner or later 😅

array_set() helper deprecated in Laravel 5.8

Hi, I believe the array_set() helper method has been deprecated in Laravel 5.8. The concrete Arr::set() class should be used instead.

https://github.com/ArondeParon/laravel-request-sanitizer/blob/6909fe4e98d0cbb8167c66eefdcb01f6561ea579/src/Traits/SanitizesInputs.php#L35

Add sanitizers which cast to common data types

Basically, implement casting to bool, int, float, string (this would likely just do nothing), and maybe dates to Carbon instances?

Sanitizing Inputs which haven't been provided

Hey @arondeparon

I just came across the following scenario. This is the sanitizers array in the request class:

protected array $sanitizers = [
  'attr.someDateAsString' => [
    Carbonize::class,
  ],
];

Now this property is optional. So the client may wish to provide it, but it must not.

The thing is, if it's not provided, the sanitizer will set the property in the request array, regardless if I want it or not.

// SanitizesInputs.php
Arr::set($input, $formKey, $sanitizer->sanitize($this->input($formKey, null)));

Is this behavior desired?

Otherwise I would suggest to wrap the line in an if statement:

// SanitizesInputs.php
if ($this->input($formKey)) {
  Arr::set($input, $formKey, $sanitizer->sanitize($this->input($formKey, null)));
}

Using custom filters alongside default filters on array properties

I've written a custom filter based on filter_var_array() and inspired by the FilterVars::class to allow an array of repeating arrays (e.g. order lines) to be validated on a per-element level. For example:

<?php

namespace App\Filters;

use ArondeParon\RequestSanitizer\Contracts\Sanitizer;

class FilterRepeatingVarArray implements Sanitizer
{
    protected array $fields;

    public function __construct($fields = [])
    {
        $this->fields = $fields;
    }

    /**
     * Sanitize the nested array using the native PHP function: filter_var_array()
     * @param $input
     * @return array|null
     * @see https://www.php.net/manual/en/function.filter-var-array.php
     */
    public function sanitize($input): ?array
    {
        if (is_null($input)) {
            return $input;
        }

        $sanitized = [];
        foreach ($input as $item) {
            $sanitized[] = filter_var_array($item, $this->fields);
        }

        return $sanitized;
    }
}

Then in the form request it's defined like this:

    protected array $sanitizers = [
        ...
        'order_line' => [
            FilterRepeatingVarArray::class => [
                'fields' => [
                    'quantity' => [
                        'filter' => FILTER_VALIDATE_INT,
                    ],
                    'price' => [
                        'filter' => FILTER_SANITIZE_NUMBER_FLOAT,
                        'flags' => FILTER_FLAG_ALLOW_FRACTION,
                        'options' => null,
                    ],
                ],
            ],
        ],
        ...
    ];

This appears to be working fine, but I'm not actually sure how I can apply any of the package's default filters to this kind of 2D array. Ironically, it's brought me back to the original reason I wrote this custom filter; I'm not sure how (or if it's currently possible) to run filter classes on nested array elements?

Thanks for the library, it's ace!