I haven't tested this yet but here is what I'm doing in case it helps anyone:
In system/library/request.php:
Replace:
Code: Select all
/**
*
* @param array $data
*
* @return array
*/
public function clean($data) {
if (is_array($data)) {
foreach ($data as $key => $value) {
unset($data[$key]);
$data[$this->clean($key)] = $this->clean($value);
}
} else {
$data = htmlspecialchars($data, ENT_COMPAT, 'UTF-8');
}
return $data;
}
With:
Code: Select all
/**
*
* @param array $data
* @param boolean $isKey Whether the value being cleaned is an array key or value
*
* @return array
*/
public function clean($data, $isKey = false) {
if (is_array($data)) {
foreach ($data as $key => $value) {
unset($data[$key]);
$data[$this->clean($key, true)] = $this->clean($value);
}
} else {
// Trim value if this isn't an array key
if (!$isKey) {
$data = trim($data);
}
$data = htmlspecialchars($data, ENT_COMPAT, 'UTF-8');
}
return $data;
}
The solutions on this thread seem like the right idea but I don't understand why the trim function is being added as a recursion map when clean($data) is already a recursion function. In theory, putting the trim function in the else statement like I have will mean it is only applied to strings (assuming the data will only ever be an array or a string) so it shouldn't lead to any errors.
Since array keys are also run through this function I have also added an 'isKey' check to ensure whitespaces are only trimmed from the values rather than the keys too.