PHP Spoofchecker class

Question

I'm reading through the PHP manual and came across the Spoofchecker class in the intl extension documentation pages. The methods in the class, their parameters, as well as the class itself are all fairly undocumented as of right now so I'm wondering what the purpose of it is.

Answer 1

The class is calling ICU' library so you may find more detail. There they say,

Because Unicode contains such a large number of characters and incorporates the varied writing systems of the world, incorrect usage can expose programs or systems to possible security attacks. This document specifies mechanisms that can be used to detect possible security problems.

Here is my short sample code using the Spoofchecker class. I myself have not used this for real site yet, but I assume that it can be useful when you need to generate and display external link from URL from your user input. If malicious person tries to take other visitors to fake sites instead of Google, Paypal, URL shortner or so, you may unlink them, or reject on its submission.

if(!extension_loaded('intl') || !class_exists("Spoofchecker")) {
    exit ('turn on php_intl extension first');
}

$checker = new Spoofchecker();

// false: all letters are in ASCII
var_dump($checker->isSuspicious("goog1e.com"));
// true: the first Cyrillic letter is from different set
var_dump($checker->isSuspicious("Рaypal.com"));

// true: digit one instead of small L
var_dump(
    $checker->areConfusable(
        'google.com',
        'goog1e.com'
    )
);

// false: digit zero and small O are not confusable
var_dump(
    $checker->areConfusable(
        'google.com',
        'g00g1e.com'
    )
);

// true: Cyrillic letter instead of P
var_dump(
    $checker->areConfusable(
        'Рaypal.com',
        'Paypal.com'
    )
);

// true: Japanese Katakana and Hiragana 'he'
var_dump(
    $checker->areConfusable(
        'ヘいせい.com',
        'ヘいせい.com'
    )
);

// true: identical detected as confusable so you might check === first
var_dump(
    $checker->areConfusable(
        'google.com',
        'google.com'
    )
);

You may check what characters are thought as confusable on this table.

Answer 2

As indicated by Mark Baker's comment, SpoofChecker is a PHP mechanism to detect possible security problems when working with Unicode strings.

Because Unicode contains such a large number of characters and incorporates the varied writing systems of the world, incorrect usage can expose programs or systems to possible security attacks.

Source: http://www.unicode.org/reports/tr39/