Input validation with filter functions
Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.
Which are available?
Below a shameless copy paste of the PHP documentation.
- filter_has_var — Checks if variable of specified type exists
- filter_id — Returns the filter ID belonging to a named filter
- filter_input_array — Gets external variables and optionally filters them
- filter_input — Gets a specific external variable by name and optionally filters it
- filter_list — Returns a list of all supported filters
- filter_var_array — Gets multiple variables and optionally filters them
- filter_var — Filters a variable with a specified filter
Pratical use
Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.
Sanitizing a single variable
$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");
Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array
filter_var_array($_POST, FILTER_SANITIZE_STRING);
Validating an email address
if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
$this->addError('Invalid email address', $sEmail);
}
Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.
$aData = array(
'student' => 'Sjoerd Maessen',
'class' => '21',
'grades' => array(
'math' => 9,
'geography' => 66,
'gymnastics' => 7.5
)
);
$aValidation = array(
'student' => FILTER_SANITIZE_STRING,
'class' => FILTER_VALIDATE_INT,
'grades' => array(
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_FORCE_ARRAY,
'options'=> array('min_range'=>0, 'max_range'=>10))
);
echo '';
var_dump(filter_var_array($aData, $aValidation));
/*array(3) {
["student"]=>
string(14) "Sjoerd Maessen"
["class"]=>
int(21) // Thats strange, my string is converted
["grades"]=>
array(3) {
["math"]=>
int(9)
["geography"]=>
bool(false) // 66 is > 10
["gymnastics"]=>
bool(false) // 7.5 is not an int
}
}*/
Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider
Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links
Filter functions
Filter flags
Pinco il? real pul qazan: Pinco r?smi sayt – Slot oyunlari Pinco-da
Scottbairl
12 Aug 25 at 12:22 am
Live casino Mandiribet [url=https://mandiwinindo.site/#]Live casino Mandiribet[/url] Bonus new member 100% Mandiribet
LarryBah
12 Aug 25 at 12:22 am
Judi online deposit pulsa [url=https://mandiwinindo.site/#]Bonus new member 100% Mandiribet[/url] Judi online deposit pulsa
LarryBah
12 Aug 25 at 1:20 am
Indian Meds One: buy prescription drugs from india – top 10 pharmacies in india
RoccoaritA
12 Aug 25 at 7:44 am
http://indianmedsone.com/# indian pharmacy online
Bruceben
12 Aug 25 at 8:34 am
india online pharmacy: online pharmacy india – Indian Meds One
JamesHeelo
12 Aug 25 at 9:32 am
MediDirect USA [url=https://medidirectusa.com/#]pharmacy global rx[/url] MediDirect USA
Houstonfloma
12 Aug 25 at 12:25 pm
Mexican Pharmacy Hub: Mexican Pharmacy Hub – best online pharmacies in mexico
Justinsoync
12 Aug 25 at 12:40 pm
pharmaceutical online ordering: stater bros super rx pharmacy – methotrexate pharmacy mistake
RoccoaritA
12 Aug 25 at 1:45 pm
Mexican Pharmacy Hub: tadalafil mexico pharmacy – buy viagra from mexican pharmacy
JamesHeelo
12 Aug 25 at 4:21 pm
Mexican Pharmacy Hub: Mexican Pharmacy Hub – pharmacies in mexico that ship to usa
Justinsoync
12 Aug 25 at 7:11 pm
Indian Meds One: Indian Meds One – mail order pharmacy india
RoccoaritA
12 Aug 25 at 7:49 pm
http://mexicanpharmacyhub.com/# mexican border pharmacies shipping to usa
Bruceben
12 Aug 25 at 9:09 pm
reputable indian pharmacies [url=https://indianmedsone.shop/#]top 10 pharmacies in india[/url] Indian Meds One
Houstonfloma
12 Aug 25 at 9:27 pm
Mexican Pharmacy Hub: Mexican Pharmacy Hub – Mexican Pharmacy Hub
JamesHeelo
12 Aug 25 at 11:04 pm
legitimate online pharmacies india: Indian Meds One – reputable indian pharmacies
Justinsoync
13 Aug 25 at 1:36 am
MediDirect USA: MediDirect USA – MediDirect USA
RoccoaritA
13 Aug 25 at 1:49 am
Mexican Pharmacy Hub: low cost mexico pharmacy online – Mexican Pharmacy Hub
JamesHeelo
13 Aug 25 at 5:51 am
buy propecia mexico [url=http://mexicanpharmacyhub.com/#]buy kamagra oral jelly mexico[/url] buy antibiotics from mexico
Houstonfloma
13 Aug 25 at 6:27 am
sildenafil mexico online: Mexican Pharmacy Hub – Mexican Pharmacy Hub
RoccoaritA
13 Aug 25 at 7:48 am
Mexican Pharmacy Hub: mexico drug stores pharmacies – mexican online pharmacies prescription drugs
Justinsoync
13 Aug 25 at 8:01 am
Mexican Pharmacy Hub: Mexican Pharmacy Hub – best online pharmacies in mexico
Justinsoync
13 Aug 25 at 8:08 am
https://mexicanpharmacyhub.shop/# Mexican Pharmacy Hub
Bruceben
13 Aug 25 at 9:38 am
indianpharmacy com: Indian Meds One – Indian Meds One
JamesHeelo
13 Aug 25 at 12:37 pm
pharmacy first fluconazole: MediDirect USA – cialis buy online pharmacy
RoccoaritA
13 Aug 25 at 2:17 pm
Mexican Pharmacy Hub: mexican mail order pharmacies – Mexican Pharmacy Hub
Justinsoync
13 Aug 25 at 3:18 pm
buy cheap meds from a mexican pharmacy [url=https://mexicanpharmacyhub.com/#]Mexican Pharmacy Hub[/url] legit mexican pharmacy for hair loss pills
Houstonfloma
13 Aug 25 at 4:09 pm
pharmacy website india: Indian Meds One – Indian Meds One
JamesHeelo
13 Aug 25 at 8:55 pm
Mexican Pharmacy Hub: Mexican Pharmacy Hub – Mexican Pharmacy Hub
RoccoaritA
13 Aug 25 at 10:01 pm
MediDirect USA: online pharmacy domperidone no prescription – tylenol pharmacy scholarship 2012
Justinsoync
13 Aug 25 at 11:14 pm
pharmacy checker viagra [url=https://medidirectusa.com/#]pharmacy online 365 discount code[/url] singulair pharmacy prices
Houstonfloma
14 Aug 25 at 2:20 am
http://indianmedsone.com/# Indian Meds One
Bruceben
14 Aug 25 at 2:44 am
safe mexican online pharmacy: buy meds from mexican pharmacy – amoxicillin mexico online pharmacy
JamesHeelo
14 Aug 25 at 5:05 am
Indian Meds One: top 10 online pharmacy in india – best online pharmacy india
RoccoaritA
14 Aug 25 at 5:50 am
indian pharmacies safe: Online medicine order – Indian Meds One
Justinsoync
14 Aug 25 at 7:30 am
Indian Meds One [url=http://indianmedsone.com/#]Indian Meds One[/url] buy medicines online in india
Houstonfloma
14 Aug 25 at 1:26 pm
Mexican Pharmacy Hub: Mexican Pharmacy Hub – cheap mexican pharmacy
JamesHeelo
14 Aug 25 at 1:54 pm
mail order pharmacy india: buy prescription drugs from india – Indian Meds One
RoccoaritA
14 Aug 25 at 2:07 pm
MediDirect USA: MediDirect USA – MediDirect USA
Justinsoync
14 Aug 25 at 4:08 pm
https://medidirectusa.com/# medical pharmacy south
Bruceben
14 Aug 25 at 9:35 pm
legit mexican pharmacy without prescription: buy from mexico pharmacy – mexican pharmacy for americans
RoccoaritA
14 Aug 25 at 10:28 pm
cetirizine pharmacy: MediDirect USA – MediDirect USA
JamesHeelo
14 Aug 25 at 10:45 pm
express pharmacy online [url=http://medidirectusa.com/#]pioneer rx pharmacy software reviews[/url] MediDirect USA
Houstonfloma
15 Aug 25 at 12:39 am
online shopping pharmacy india: Indian Meds One – best online pharmacy india
Justinsoync
15 Aug 25 at 12:49 am
ultram us pharmacy: MediDirect USA – MediDirect USA
RoccoaritA
15 Aug 25 at 6:54 am
propranolol uk pharmacy: asda viagra in pharmacy – guardian pharmacy singapore propecia
JamesHeelo
15 Aug 25 at 7:39 am
https://mexicanpharmacyhub.shop/# Mexican Pharmacy Hub
Bruceben
15 Aug 25 at 7:42 am
lamisil boots pharmacy: Viagra Gold – MediDirect USA
Justinsoync
15 Aug 25 at 9:50 am
Tadalify [url=https://tadalify.com/#]Tadalify[/url] Tadalify
RobertCat
15 Aug 25 at 2:52 pm
Tadalify: Tadalify – Tadalify
ElijahKic
15 Aug 25 at 3:37 pm