Polyfill for FILTER_SANITIZE_STRING deprecated as of PHP 8.1.0

filter_sanitize_string.php

<?php
function filter_sanitize_string($value, $flags = 0) {
    if ($flags & FILTER_FLAG_EMPTY_STRING_NULL && $value === "") {
        return null;
    }
    if (!(is_scalar($value) || is_null($value))) {
        return false;
    }

    // Strip HTML tags and remove NUL bytes
    $value = (string)$value;
    $value = strip_tags($value);
    $value = str_replace("\0", "", $value);

    // Low/High ASCII handling (byte-by-byte to match legacy behavior)
    $output = "";
    for ($i = 0, $n = strlen($value); $i < $n; $i++) {
        $char = $value[$i];
        $ord = ord($char);

        if ($ord < 32) {
            if ($flags & FILTER_FLAG_STRIP_LOW)
                continue;
            if ($flags & FILTER_FLAG_ENCODE_LOW) {
                $output .= "&#$ord;";
                continue;
            }
        }

        if ($ord > 127) {
            if ($flags & FILTER_FLAG_STRIP_HIGH)
                continue;
            if ($flags & FILTER_FLAG_ENCODE_HIGH) {
                $output .= "&#$ord;";
                continue;
            }
        }

        $output .= $char;
    }

    // Strip backticks; fixes bug PHP_VERSION < 5.5.24
	if ($flags & FILTER_FLAG_STRIP_BACKTICK) {
        $output = str_replace('`', '', $output);
    }

    // Legacy ONLY encoded ampersands if FILTER_FLAG_ENCODE_AMP was set
    if ($flags & FILTER_FLAG_ENCODE_AMP) {
        $output = str_replace('&', '&amp;', $output);
    }

    // Replicate legacy quote encoding exactly (&#39; and &#34;)
    if (!($flags & FILTER_FLAG_NO_ENCODE_QUOTES)) {
        $output = str_replace(["'", '"'], ['&#39;', '&#34;'], $output);
    }

	return $output;
}

Polyfill tests

$string = "It's a \"test\" \x02 <script> > & ©";

$sanitized = filter_var($string, FILTER_CALLBACK, [
     'options' => function($value) {
         return filter_sanitize_string($value, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
     }
 ]);
var_dump($sanitized);
$sanitized = filter_sanitize_string($string, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
var_dump($sanitized);
$sanitized = filter_sanitize_string(array(), FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
var_dump($sanitized);
$sanitized = filter_sanitize_string(null, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
var_dump($sanitized);
$sanitized = filter_sanitize_string(false, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
var_dump($sanitized);
$sanitized = filter_sanitize_string($string);
var_dump($sanitized);

string(42) "It's a "test"   > & ©"
string(42) "It's a "test"   > & ©"
bool(false)
string(0) ""
string(0) ""
string(35) "It's a "test"    > & ©"

Deprecated tests

$sanitized = filter_var($string, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
var_dump($sanitized);
$sanitized = filter_var(array(), FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
var_dump($sanitized);
$sanitized = filter_var(null, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
var_dump($sanitized);
$sanitized = filter_var(false, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
var_dump($sanitized);
$sanitized = filter_var($string, FILTER_SANITIZE_STRING);
var_dump($sanitized);

string(42) "It's a "test"   > & ©"
bool(false)
string(0) ""
string(0) ""
string(35) "It's a "test"    > & ©"

General filter flags to be applied at the 2nd arg of filter_var(), in 'flags' key value:

$sanitized = filter_var(array(), FILTER_CALLBACK, [
     'options' => function($value) {
         return filter_sanitize_string($value, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
     },
     'flags' => FILTER_NULL_ON_FAILURE,
 ]);
var_dump($sanitized);

NULL

$sanitized = filter_var(array(), FILTER_CALLBACK, [
     'options' => function($value) {
         return filter_sanitize_string($value, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH);
     },
 ]);
var_dump($sanitized);

array(0) {
}