########################## strong sanitization (0)

htmlspecialchars=0
htmlentities=0
intval=0
floor=0
mysql_num_rows=0
mysql_error=0
count=0
sizeof=0
urlencode=0
rawurlencode=0
mt_rand=0
rand=0
strlen=0
phpversion=0
round=0
microtime=0
time=0
ob_get_clean=0
chr=0
getimagesize=0
filesize=0
strrpos=0
ini_get=0
gzcompress=0
pack=0
md5=0
hexdec=0
posix_getpwuid=0
posix_getgrgid=0

# "clean database" policy

mysql_fetch_array=0
mysql_fetch_row=0
mysql_fetch_assoc=0
mysql_query=0

# "clean files" policy

file=0
readdir=0
fread=0
fgets=0
opendir=0

# "clean environment" policy

getenv=0

# translation tables are usually harmless

ngettext=0
dgettext=0
dngettext=0

# harmless operators

# both binary and unary
op(PLUS)=0
# both binary and unary
op(MINUS)=0
op(MULT)=0
op(DIV)=0
op(MODULO)=0
op(BOOLEAN_AND)=0
op(IS_EQUAL)=0
op(IS_NOT_EQUAL)=0
op(IS_SMALLER)=0
op(IS_GREATER)=0
op(IS_SMALLER_OR_EQUAL)=0
op(IS_GREATER_OR_EQUAL)=0
op(IS_IDENTICAL)=0
op(IS_NOT_IDENTICAL)=0
op(SL)=0
op(SR)=0
op(NOT)=0
op(INT_CAST)=0
op(DOUBLE_CAST)=0
op(BOOL_CAST)=0
op(UNSET_CAST)=0

############################## weak sanitization (1)

############################## multi-dependency (2)


addslashes=2:0
base64_decode=2:0
basename=2:0
date=2:0
dirname=2:0
gmdate=2:0
ltrim=2:0
nl2br=2:0
pathinfo=2:0
realpath=2:0
rtrim=2:0
serialize=2:0
session_id=2:0
str_repeat=2:0
strftime=2:0
stripcslashes=2:0
stripslashes=2:0
strstr=2:0
strtolower=2:0
strtoupper=2:0
substr=2:0
trim=2:0
ucfirst=2:0
uniqid=2:0
var_export=2:0
op(BITWISE_NOT)=2:0
op(STRING_CAST)=2:0
op(ARRAY_CAST)=2:0
op(OBJECT_CAST)=2:0

explode=2:1
split=2:1
strtr=2:1
gethostbyaddr=2:1

implode=2:0:1
op(CONCAT)=2:0:1
op(BITWISE_OR)=2:0:1
op(BITWISE_AND)=2:0:1
op(BITWISE_XOR)=2:0:1

ereg_replace=2:1:2
eregi_replace=2:1:2
preg_replace=2:1:2
str_replace=2:1:2

number_format=2:0:2:3

array_keys=2:0
array_reverse=2:0
array_values=2:0
each=2:0

############################## inverse multi-dependency (3)

sprintf=3
max=3
min=3
# this one is an approximation
array_map=3:0


############################## evil functions (4)

urldecode=4
rawurldecode=4
strip_tags=4


