Apply FILTER_SANITIZE or real_escape_string to all fields of a json

Question

Good I have to apply one FILTER_SANITIZE_SPECIAL_CHARS on dodos the fields of a json.

Currently receives json like this:

// Recebo o json
$json = filter_input(INPUT_POST, 'json', FILTER_DEFAULT);

// Decodifica o Json
$obj = json_decode($json);

// Aqui eu tenho que aplicar o `FILTER_SANITIZE_SPECIAL_CHARS`

The json var_dump:

{
 "Autenticacao": {
    "login": "100",
    "senha": "123"
 },
 "operacao": {
    "nome": "hugo",
    "endereco": "rua sei la",
    "numero": "123"
 }
}

How to navigate the fields login,senha,nome,endereco and numero applying the FILTER_SANITIZE_SPECIAL_CHARS?

Edith ----------------------------

I tried with the real_escape_string as follows:

foreach ($obj as &$main) {
            foreach ($main as &$value) {
                $value = $conexao->real_escape_string($value);
            }
        }

But I’m having this mistake:

mysqli::real_escape_string() expects parameter 1 to be string, object given in 

Answer 1

Using two foreachs and add the & ("E" commercial) the value variables of foreach to create a reference:

foreach ($obj as &$main) {
    foreach ($main as &$value) {
        $value = filter_var($value, FILTER_SANITIZE_SPECIAL_CHARS);
    }
}

See what happens if you use INT in one of the fields and boolean in the other in jsfiddle: https://ideone.com/5hVH3d, code:

<?php

$obj = json_decode('{
 "Autenticacao": {
    "login": 100000000000,
    "senha": "123"
 },
 "operacao": {
    "nome": false,
    "endereco": "rua sei la",
    "numero": "123"
 }
}');

foreach ($obj as &$main) {
    foreach ($main as &$value) {
        $value = filter_var($value, FILTER_SANITIZE_SPECIAL_CHARS);
    }
}

var_dump($obj);

The name field becomes an empty string and the login field becomes a string in number format, but it is no longer "int", see the result of var_dump($obj); the fields were changed directly in the $obj:

object(stdClass)#2 (2) {
  ["Autenticacao"]=>
  object(stdClass)#1 (2) {
    ["login"]=>
    string(12) "100000000000" <--------- AQUI
    ["senha"]=>
    string(3) "123"
  }
  ["operacao"]=>
  &object(stdClass)#3 (3) {
    ["nome"]=>
    string(0) "" <--------- AQUI
    ["endereco"]=>
    string(10) "rua sei la"
    ["numero"]=>
    &string(3) "123"
  }
}

The change affected directly the variable $obj due to e-comerical, according to the PHP documentation:

• http://php.net/manual/en/language.references.whatare.php
• http://php.net/manual/en/language.references.whatdo.php
• http://php.net/manual/en/language.references.arent.php

With mysql and real_escape

You can do it like this:

<?php
$mysqli = new mysqli("localhost", "usuario", "senha", "banco");

...

foreach ($obj as &$main) {
    foreach ($main as &$value) {
        $value = $mysqli->real_escape_string($value);
    }
}

If it is procedural:

<?php
$mysqli = mysqli_connect("localhost", "usuario", "senha", "banco");

...

foreach ($obj as &$main) {
    foreach ($main as &$value) {
        $value = mysqli_real_escape_string($mysqli, $value);
    }
}

Answer 2

For this question I decided to do a small function, which only works if the json is only 1 degree but solves the situation well.

OBS the variable is passed by reference which means it will be changed, $json = saveJson($obj);

OBS The current filter is FILTER_SANITIZE_STRING , choose one that fits your needs

function saveJson(&$json)
{
    foreach($json as $key => $object)
    {
        foreach($object as $key1 => $o)
        {
            $json->$key->$key1 = filter_var($o, FILTER_SANITIZE_STRING);
        } 
    }
}