Changeset 10769

Timestamp:

03/11/2009 03:26:34 PM (16 years ago)

Author:

ryan

Message:

Improved is_email() and sanitize_email(). Props sambauers. fixes #9316 #4616

File:

• trunk/wp-includes/formatting.php (modified) (2 diffs)

trunk/wp-includes/formatting.php

@@ -1294 +1294 @@
 
 /**
- * Checks to see if the text is a valid email address.
+ * Verifies that an email is valid.
+ *
+ * Does not grok i18n domains. Not RFC compliant.
  *
  * @since 0.71
  *
- * @param string $user_email The email address to be checked.
- * @return bool Returns true if valid, otherwise false.
- */
-function is_email($user_email) {
-    $chars = "/^([a-z0-9+_]|\\-|\\.)+@(([a-z0-9_]|\\-)+\\.)+[a-z]{2,6}\$/i";
-    if (strpos($user_email, '@') !== false && strpos($user_email, '.') !== false) {
-        if (preg_match($chars, $user_email)) {
-            return true;
-        } else {
-            return false;
+ * @param string $email Email address to verify.
+ * @param boolean $check_dns Whether to check the DNS for the domain using checkdnsrr().
+ * @return string|bool Either false or the valid email address.
+ */
+function is_email( $email, $check_dns = false ) {
+    // Test for the minimum length the email can be
+    if ( strlen( $email ) < 3 ) {
+        return apply_filters( 'is_email', false, $email, 'email_too_short' );
+    }
+
+    // Test for an @ character after the first position
+    if ( strpos( $email, '@', 1 ) === false ) {
+        return apply_filters( 'is_email', false, $email, 'email_no_at' );
+    }
+
+    // Split out the local and domain parts
+    list( $local, $domain ) = explode( '@', $email, 2 );
+
+    // LOCAL PART
+    // Test for invalid characters
+    if ( !preg_match( '/^[a-zA-Z0-9!#$%&\'*+\/=?^_`{|}~\.-]+$/', $local ) ) {
+        return apply_filters( 'is_email', false, $email, 'local_invalid_chars' );
+    }
+
+    // DOMAIN PART
+    // Test for sequences of periods
+    if ( preg_match( '/\.{2,}/', $domain ) ) {
+        return apply_filters( 'is_email', false, $email, 'domain_period_sequence' );
+    }
+
+    // Test for leading and trailing periods and whitespace
+    if ( trim( $domain, " \t\n\r\0\x0B." ) !== $domain ) {
+        return apply_filters( 'is_email', false, $email, 'domain_period_limits' );
+    }
+
+    // Split the domain into subs
+    $subs = explode( '.', $domain );
+
+    // Assume the domain will have at least two subs
+    if ( 2 > count( $subs ) ) {
+        return apply_filters( 'is_email', false, $email, 'domain_no_periods' );
+    }
+
+    // Loop through each sub
+    foreach ( $subs as $sub ) {
+        // Test for leading and trailing hyphens and whitespace
+        if ( trim( $sub, " \t\n\r\0\x0B-" ) !== $sub ) {
+            return apply_filters( 'is_email', false, $email, 'sub_hyphen_limits' );
         }
-    } else {
-        return false;
-    }
+
+        // Test for invalid characters
+        if ( !preg_match('/^[a-z0-9-]+$/i', $sub ) ) {
+            return apply_filters( 'is_email', false, $email, 'sub_invalid_chars' );
+        }
+    }
+
+    // DNS
+    // Check the domain has a valid MX and A resource record
+    if ( $check_dns && function_exists( 'checkdnsrr' ) && !( checkdnsrr( $domain . '.', 'MX' ) || checkdnsrr( $domain . '.', 'A' ) ) ) {
+        return apply_filters( 'is_email', false, $email, 'dns_no_rr' );
+    }
+
+    // Congratulations your email made it!
+    return apply_filters( 'is_email', $email, $email, null );
 }
 
@@ -1449 +1501 @@
  * @return string Filtered email address.
  */
-function sanitize_email($email) {
-    return preg_replace('/[^a-z0-9+_.@-]/i', '', $email);
+function sanitize_email( $email ) {
+    // Test for the minimum length the email can be
+    if ( strlen( $email ) < 3 ) {
+        return apply_filters( 'sanitize_email', '', $email, 'email_too_short' );
+    }
+
+    // Test for an @ character after the first position
+    if ( strpos( $email, '@', 1 ) === false ) {
+        return apply_filters( 'sanitize_email', '', $email, 'email_no_at' );
+    }
+
+    // Split out the local and domain parts
+    list( $local, $domain ) = explode( '@', $email, 2 );
+
+    // LOCAL PART
+    // Test for invalid characters
+    $local = preg_replace( '/^[a-zA-Z0-9!#$%&\'*+\/=?^_`{|}~\.-]+$/', '', $local );
+    if ( '' === $local ) {
+        return apply_filters( 'sanitize_email', '', $email, 'local_invalid_chars' );
+    }
+
+    // DOMAIN PART
+    // Test for sequences of periods
+    $domain = preg_replace( '/\.{2,}/', '', $domain );
+    if ( '' === $domain ) {
+        return apply_filters( 'sanitize_email', '', $email, 'domain_period_sequence' );
+    }
+
+    // Test for leading and trailing periods and whitespace
+    $domain = trim( $domain, " \t\n\r\0\x0B." );
+    if ( '' === $domain ) {
+        return apply_filters( 'sanitize_email', '', $email, 'domain_period_limits' );
+    }
+
+    // Split the domain into subs
+    $subs = explode( '.', $domain );
+
+    // Assume the domain will have at least two subs
+    if ( 2 > count( $subs ) ) {
+        return apply_filters( 'sanitize_email', '', $email, 'domain_no_periods' );
+    }
+
+    // Create an array that will contain valid subs
+    $new_subs = array();
+
+    // Loop through each sub
+    foreach ( $subs as $sub ) {
+        // Test for leading and trailing hyphens
+        $sub = trim( $sub, " \t\n\r\0\x0B-" );
+
+        // Test for invalid characters
+        $sub = preg_replace( '/^[^a-z0-9-]+$/i', '', $sub );
+
+        // If there's anything left, add it to the valid subs
+        if ( '' !== $sub ) {
+            $new_subs[] = $sub;
+        }
+    }
+
+    // If there aren't 2 or more valid subs
+    if ( 2 > count( $new_subs ) ) {
+        return apply_filters( 'sanitize_email', '', $email, 'domain_no_valid_subs' );
+    }
+
+    // Join valid subs into the new domain
+    $domain = join( '.', $new_subs );
+
+    // Put the email back together
+    $email = $local . '@' . $domain;
+
+    // Congratulations your email made it!
+    return apply_filters( 'sanitize_email', $email, $email, null );
 }