Home/ Manual/ taint / functions/ untaint

untaint

PHP function Edit on GitHub ✎

(PECL taint >=0.1.0)

Remove the taint mark from strings

Description

untaint(string $string, string ...$strings): bool

Clears the taint mark on the given strings.

The mark is stored on the string itself, not on the variable, so this clears it for every variable sharing the same string at once. Use it to whitelist values you have validated yourself, for example after a strict allow-list check.

Parameters

string: A variable holding the string to clean.
strings: Further variables to clean.

Return Values

Always returns true. When taint.enable is off, the function does nothing and still returns true.

Examples

untaint() example

php

<?php
$id = "42";
taint($id);
if (preg_match('/^\d+$/', $id)) {
    // strictly validated as digits: safe to trust
    untaint($id);
}
var_dump(is_tainted($id));
?>

The above example will output something similar to:

output

bool(false)

Notes

Note

Only string values can carry the mark; passing a non-string is a no-op.