Input validation with filter functions
Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.
Which are available?
Below a shameless copy paste of the PHP documentation.
- filter_has_var — Checks if variable of specified type exists
- filter_id — Returns the filter ID belonging to a named filter
- filter_input_array — Gets external variables and optionally filters them
- filter_input — Gets a specific external variable by name and optionally filters it
- filter_list — Returns a list of all supported filters
- filter_var_array — Gets multiple variables and optionally filters them
- filter_var — Filters a variable with a specified filter
Pratical use
Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.
Sanitizing a single variable
$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");
Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array
filter_var_array($_POST, FILTER_SANITIZE_STRING);
Validating an email address
if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
$this->addError('Invalid email address', $sEmail);
}
Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.
$aData = array(
'student' => 'Sjoerd Maessen',
'class' => '21',
'grades' => array(
'math' => 9,
'geography' => 66,
'gymnastics' => 7.5
)
);
$aValidation = array(
'student' => FILTER_SANITIZE_STRING,
'class' => FILTER_VALIDATE_INT,
'grades' => array(
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_FORCE_ARRAY,
'options'=> array('min_range'=>0, 'max_range'=>10))
);
echo '';
var_dump(filter_var_array($aData, $aValidation));
/*array(3) {
["student"]=>
string(14) "Sjoerd Maessen"
["class"]=>
int(21) // Thats strange, my string is converted
["grades"]=>
array(3) {
["math"]=>
int(9)
["geography"]=>
bool(false) // 66 is > 10
["gymnastics"]=>
bool(false) // 7.5 is not an int
}
}*/
Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider
Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links
Filter functions
Filter flags
apotheke: Medicijn Punt – pharmacy online netherlands
Altonjah
17 Jul 25 at 9:01 am
l serin apotek [url=https://tryggmed.com/#]TryggMed[/url] castile sГҐpe apotek
ScottFup
17 Jul 25 at 9:24 am
https://zorgpakket.shop/# apotheek online
MichaelDeeli
17 Jul 25 at 9:33 am
apotek kondomer: SnabbApoteket – kalcium mat lista
Kennethrip
17 Jul 25 at 10:00 am
https://tryggmed.com/# kjГёnnssykdommer test apotek
WilliamNog
17 Jul 25 at 12:03 pm
apotek lГ¤ppbalsam: SnabbApoteket – nГ¤sspray fГ¶r rinnsnuva
Altonjah
17 Jul 25 at 4:19 pm
http://tryggmed.com/# mandelolje apotek
MichaelDeeli
17 Jul 25 at 4:21 pm
Vodka Casino https://vodkasloty.com — русскоязычная платформа с множеством слотов от NetEnt, Pragmatic Play, Evolution Gaming. Лицензия Кюрасао обеспечивает безопасность. Стильный интерфейс с яркими элементами, удобная навигация и мобильная версия.
OLaneDrync
17 Jul 25 at 4:22 pm
medicatie bestellen apotheek [url=http://zorgpakket.com/#]medicijnen bestellen online[/url] medicatie bestellen apotheek
ScottFup
17 Jul 25 at 5:10 pm
medicatie aanvragen: medicijnen online kopen – medicijn online bestellen
Kennethrip
17 Jul 25 at 5:31 pm
https://tryggmed.shop/# tabletter
MichaelDeeli
17 Jul 25 at 11:39 pm
de apotheker: apohteek – medicijn online bestellen
Altonjah
17 Jul 25 at 11:56 pm
apotek omega 3 [url=https://tryggmed.shop/#]kjГёnnssykdom test apotek[/url] alkoholtest apotek
ScottFup
18 Jul 25 at 1:22 am
ГҐpent apotek sГёndag: Trygg Med – apotek dГёgnГҐpent
Kennethrip
18 Jul 25 at 1:33 am
https://zorgpakket.com/# apotheken nederland
WilliamNog
18 Jul 25 at 3:47 am
https://zorgpakket.shop/# farma
MichaelDeeli
18 Jul 25 at 6:37 am
medicijnen kopen met ideal: MedicijnPunt – online medicijnen kopen
Altonjah
18 Jul 25 at 7:31 am
blodgrupp test apotek: nГ¤sspray frГҐn 1 ГҐr – kГ¶pa diklofenak pГҐ nГ¤tet
Kennethrip
18 Jul 25 at 8:58 am
https://zorgpakket.shop/# online apotheek recept
WilliamNog
18 Jul 25 at 9:00 am
Good shout.
best THC gummies
18 Jul 25 at 9:10 am
IndiaMedsHub [url=https://indiamedshub.com/#]IndiaMedsHub[/url] indianpharmacy com
DavidRhinc
18 Jul 25 at 10:20 am
http://medimexicorx.com/# reputable mexican pharmacies online
RobertEmard
18 Jul 25 at 1:04 pm
top 10 online pharmacy in india: india pharmacy mail order – reputable indian pharmacies
BobbyAcany
18 Jul 25 at 3:22 pm
MediMexicoRx [url=https://medimexicorx.shop/#]cheap cialis mexico[/url] MediMexicoRx
DavidRhinc
18 Jul 25 at 4:27 pm
http://indiamedshub.com/# pharmacy website india
Vernonhon
18 Jul 25 at 4:48 pm
world pharmacy india: IndiaMedsHub – IndiaMedsHub
LewisSoump
18 Jul 25 at 5:33 pm
https://indiamedshub.com/# top online pharmacy india
RobertEmard
18 Jul 25 at 6:25 pm
MediMexicoRx: buy from mexico pharmacy – MediMexicoRx
BobbyAcany
18 Jul 25 at 8:48 pm
MediMexicoRx [url=https://medimexicorx.com/#]buy kamagra oral jelly mexico[/url] MediMexicoRx
DavidRhinc
18 Jul 25 at 10:24 pm
https://expresscarerx.online/# best online propecia pharmacy
RobertEmard
18 Jul 25 at 11:35 pm
пансионат для лежачих пожилых
pansionat-msk002.ru
частные пансионаты для пожилых в москве
alkogolizmkrasnodarNeT
18 Jul 25 at 11:37 pm