PHP var security

PHPsec

Looking for functions to clean vars for different situations.

Can you improve on these, returning strings, urls and numbers:

function strClean($var) {
	// returns converted entities where there are HTML entity equivalents
	return htmlentities($var, ENT_QUOTES, "UTF-8");
}

function urlClean($var) {
	// returns a-z A-Z 0-9 / - . _ chars only
	return preg_replace('/[^a-zA-Z0-9\/\-\._]/si','',$var);  
}

function numClean($var) {
	// returns a number, whole or decimal or null
	return is_numeric($var) ? floatval($var) : false;
}

@jedisct1 Many thanks for the advice and sorry I didn't provide context.

Usage will be sanitising user input via GET & POST and either rendered to screen or used in a SQL command, though we'll use PDO so they're safe (?) anyway. Aiming to prevent user hack attempts & bot attacks, especially SQL injection, XSS and remote file ref injection. Am not using a template, it's a PHP & HTML mix and want to call the appropriate function to get back a clean value.

Am using htmlentities in strClean, as it's the same as htmlspecialchars but also covers html equivalents. htmlspecialchars doesn't protect against \ or 0x attacks. I believe htmlentities extends the idea of htmlspecialchars to all covert chars with html equivalents or kills them.

urlClean is supposed to only allow safe chars in URLs, including the query string. Need something better here I think as / and & can form dangerous chars.

No, you're right, I don't want to return 0 in numClean on failures, so I'm now conditionally returning false. I changed it from being inval to *1 so it now covers decimals too.

To clean an URL I would use parse_url() and work with the returned array. To clean a number I always use (int)$var; and (float)$var;. You can use intval($var); and floatval($var); if you want. Also there is an is_numeric() function so your code may look like this:

function numClean($var) {
    return is_numeric($var) ? floatval($var) : false;
}

@maettig Thanks. Used that as a better solution to my $var*1 === $var ? $var : false; effort. Will use look at parse_url to get the various elems and then sanitise the values as @jedisct1 suggested.