Skip to content

Email Sanitizer permits leading $ which is not a valid selector #2076

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jefhar opened this issue May 20, 2025 · 0 comments
Open

Email Sanitizer permits leading $ which is not a valid selector #2076

jefhar opened this issue May 20, 2025 · 0 comments

Comments

@jefhar
Copy link

jefhar commented May 20, 2025

We've run into an issue where an email with a leading $ cannot be used to fetch a user.

An email address containing a $ is technically legal. However, starting the email address with that character breaks ProcessWire, and the Sanitizer returns a string with a leading $.

use function ProcessWire\wire;

$email = '[email protected]';
$email = wire('sanitizer')->email($email); // "[email protected]"
wire('users')->get('email=' . $email);

>>  ProcessWire\WireException  Unrecognized operator: $.

Adding a $ to the middle of an email address does not break the selector.

use function ProcessWire\wire;

$email = '[email protected]';
$email = wire('sanitizer')->email($email); "ema$il@example.net"
wire('users')->get('email=' . $email);

>> ProcessWire\NullPage
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant