Input validation with filter functions
Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.
Which are available?
Below a shameless copy paste of the PHP documentation.
- filter_has_var — Checks if variable of specified type exists
- filter_id — Returns the filter ID belonging to a named filter
- filter_input_array — Gets external variables and optionally filters them
- filter_input — Gets a specific external variable by name and optionally filters it
- filter_list — Returns a list of all supported filters
- filter_var_array — Gets multiple variables and optionally filters them
- filter_var — Filters a variable with a specified filter
Pratical use
Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.
Sanitizing a single variable
$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");
Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array
filter_var_array($_POST, FILTER_SANITIZE_STRING);
Validating an email address
if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
$this->addError('Invalid email address', $sEmail);
}
Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.
$aData = array(
'student' => 'Sjoerd Maessen',
'class' => '21',
'grades' => array(
'math' => 9,
'geography' => 66,
'gymnastics' => 7.5
)
);
$aValidation = array(
'student' => FILTER_SANITIZE_STRING,
'class' => FILTER_VALIDATE_INT,
'grades' => array(
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_FORCE_ARRAY,
'options'=> array('min_range'=>0, 'max_range'=>10))
);
echo '';
var_dump(filter_var_array($aData, $aValidation));
/*array(3) {
["student"]=>
string(14) "Sjoerd Maessen"
["class"]=>
int(21) // Thats strange, my string is converted
["grades"]=>
array(3) {
["math"]=>
int(9)
["geography"]=>
bool(false) // 66 is > 10
["gymnastics"]=>
bool(false) // 7.5 is not an int
}
}*/
Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider
Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links
Filter functions
Filter flags
IntimGesund: potenzmittel diskret bestellen – Potenzmittel Generika online kaufen
Israelpaync
16 Sep 25 at 2:36 am
PotenzApotheke: rezeptfreie medikamente für erektionsstörungen – günstigste online apotheke
Donaldanype
16 Sep 25 at 3:59 am
eu apotheke ohne rezept [url=https://gesunddirekt24.com/#]rezeptfreie arzneimittel online kaufen[/url] online apotheke gГјnstig
StevenTilia
16 Sep 25 at 4:02 am
gГјnstigste online apotheke: rezeptfreie arzneimittel online kaufen – online apotheke
Israelpaync
16 Sep 25 at 4:35 am
https://korolevachiana.github.io/FiveText/index.html Королева Чиана – это мастер слова, чьи произведения переносят читателя в другой мир, где кипят страсти, разворачиваются интриги и решаются судьбы. Её книги – это идеальный выбор для тех, кто ценит глубокий смысл, яркие образы и непредсказуемый сюжет.
AllanCef
16 Sep 25 at 5:08 am
микроигольчатый рф лифтинг лица [url=https://rf-lifting-moskva.ru/]микроигольчатый рф лифтинг лица[/url] .
RF lifting v Moskve_kmOi
16 Sep 25 at 5:09 am
https://gesunddirekt24.com/# online apotheke
Williamves
16 Sep 25 at 5:20 am
tadalafil 20mg preisvergleich: rezeptfreie medikamente für erektionsstörungen – europa apotheke
Donaldanype
16 Sep 25 at 12:34 pm
beste online-apotheke ohne rezept [url=http://mannerkraft.com/#]potenzmittel ohne rezept deutschland[/url] online apotheke rezept
StevenTilia
16 Sep 25 at 12:40 pm
https://intimgesund.com/# kamagra kaufen ohne rezept online
EnriqueVox
16 Sep 25 at 12:47 pm
eu apotheke ohne rezept: apotheke ohne wartezeit und arztbesuch – eu apotheke ohne rezept
Israelpaync
16 Sep 25 at 12:50 pm
Je suis fou de VBet Casino, on dirait une eruption de plaisirs incandescents. L’eventail de jeux du casino est une lave de delices, comprenant des jeux de casino adaptes aux cryptomonnaies. Le service client du casino est une torche d’efficacite, avec une aide qui jaillit comme une flamme. Les gains du casino arrivent a une vitesse eruptive, par moments des recompenses de casino supplementaires feraient exploser. Globalement, VBet Casino c’est un casino a explorer sans tarder pour les passionnes de casinos en ligne ! De surcroit le design du casino est un spectacle visuel brulant, amplifie l’immersion totale dans le casino.
vbet fortune tiger demo|
fizzyglitterlemur9zef
16 Sep 25 at 2:42 pm
Estou alucinado com BetorSpin Casino, e um cassino online que gira como um asteroide em chamas. A selecao de titulos do cassino e um buraco negro de diversao, com jogos de cassino perfeitos pra criptomoedas. O suporte do cassino ta sempre na ativa 24/7, garantindo suporte de cassino direto e sem buracos negros. Os saques no cassino sao velozes como uma viagem interestelar, mesmo assim mais bonus regulares no cassino seria intergalactico. Em resumo, BetorSpin Casino vale demais explorar esse cassino para os astronautas do cassino! Alem disso o design do cassino e um espetaculo visual intergalactico, adiciona um toque de brilho estelar ao cassino.
betorspin bГґnus|
glimmerfizzytoad7zef
16 Sep 25 at 2:42 pm
Казино Вавада считается одним из лидеров рынка.
Бонусные предложения дают возможность начать бесплатно.
Регулярные активности делают процесс динамичным.
Игровой каталог пополняется новыми провайдерами.
Начать игру можно быстро, и промокоды активируются моментально.
Узнай больше прямо здесь: https://mile-hydrate.com
Leroyvak
16 Sep 25 at 3:24 pm
medikament ohne rezept notfall: GesundDirekt24 – internet apotheke
Israelpaync
16 Sep 25 at 9:20 pm
ohne rezept apotheke: europa apotheke – online apotheke deutschland
Donaldanype
16 Sep 25 at 9:30 pm
п»їshop apotheke gutschein [url=http://mannerkraft.com/#]generika potenzmittel online bestellen[/url] internet apotheke
StevenTilia
16 Sep 25 at 9:34 pm
Galera, nao podia deixar de comentar no 4PlayBet Casino porque nao e so mais um cassino online. A variedade de jogos e simplesmente incrivel: slots modernos, todos bem otimizados ate no celular. O suporte foi eficiente, responderam em minutos pelo chat, algo que vale elogio. Fiz saque em cartao e o dinheiro entrou em minutos, ponto fortissimo. Se tivesse que criticar, diria que seria legal torneios de slots, mas isso nao estraga a experiencia. Pra concluir, o 4PlayBet Casino vale demais a pena. Recomendo sem medo.
bet 4play bet|
neonfalcon88zef
16 Sep 25 at 9:35 pm
Curto demais a energia de BR4Bet Casino, tem uma energia de jogo tao ardente quanto uma fogueira a meia-noite. Tem uma enxurrada de jogos de cassino irados. oferecendo sessoes ao vivo que reluzem como chamas. O suporte e uma luz-guia brilhante. com ajuda que ilumina como uma tocha. As transacoes sao faceis como um brilho. porem mais bonus seriam um diferencial reluzente. Na real, BR4Bet Casino e um cassino online que e um farol de diversao para os viciados em emocoes de cassino! Adicionalmente o design e fluido como uma lanterna. fazendo o cassino brilhar como um farol.
avaliações sobre br4bet|
quirkyblazepenguin3zef
16 Sep 25 at 9:36 pm
Estou alucinado com MarjoSports Casino, tem uma energia de jogo tao vibrante quanto uma torcida em delirio. A selecao de titulos e uma rede de prazeres. oferecendo sessoes ao vivo que marcam como gols. Os agentes voam como jogadores. com ajuda que marca gol como um penalti. Os pagamentos sao seguros e fluidos. ocasionalmente mais giros gratis seriam uma loucura de torcida. Na real, MarjoSports Casino e o point perfeito pros fas de cassino para os viciados em emocoes de cassino! Alem disso a plataforma marca gol com um visual vibrante. adicionando um toque de drible ao cassino.
aposta online marjosports|
twistyneonemu2zef
16 Sep 25 at 9:46 pm
cizwjs
🗓 💲 Crypto Reward: 1.75 bitcoin added. Access here → https://graph.org/Get-your-BTC-09-04?hs=1c988338b2d81320bb388cb9065e9bd7& 🗓
16 Sep 25 at 11:00 pm