Input validation with filter functions
Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.
Which are available?
Below a shameless copy paste of the PHP documentation.
- filter_has_var — Checks if variable of specified type exists
- filter_id — Returns the filter ID belonging to a named filter
- filter_input_array — Gets external variables and optionally filters them
- filter_input — Gets a specific external variable by name and optionally filters it
- filter_list — Returns a list of all supported filters
- filter_var_array — Gets multiple variables and optionally filters them
- filter_var — Filters a variable with a specified filter
Pratical use
Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.
Sanitizing a single variable
$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");
Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array
filter_var_array($_POST, FILTER_SANITIZE_STRING);
Validating an email address
if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
$this->addError('Invalid email address', $sEmail);
}
Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.
$aData = array(
'student' => 'Sjoerd Maessen',
'class' => '21',
'grades' => array(
'math' => 9,
'geography' => 66,
'gymnastics' => 7.5
)
);
$aValidation = array(
'student' => FILTER_SANITIZE_STRING,
'class' => FILTER_VALIDATE_INT,
'grades' => array(
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_FORCE_ARRAY,
'options'=> array('min_range'=>0, 'max_range'=>10))
);
echo '';
var_dump(filter_var_array($aData, $aValidation));
/*array(3) {
["student"]=>
string(14) "Sjoerd Maessen"
["class"]=>
int(21) // Thats strange, my string is converted
["grades"]=>
array(3) {
["math"]=>
int(9)
["geography"]=>
bool(false) // 66 is > 10
["gymnastics"]=>
bool(false) // 7.5 is not an int
}
}*/
Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider
Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links
Filter functions
Filter flags
aarp medicare rx pharmacy directory [url=https://maplemedsdirect.com/#]MapleMeds Direct[/url] flomax pharmacy questionnaire
KennethFax
26 Aug 25 at 11:40 pm
boots pharmacy cialis: purdue pharmacy store – tijuana pharmacy online
Haroldepife
27 Aug 25 at 12:46 am
princeton u store pharmacy: MapleMeds Direct – diazepam online pharmacy
Anthonypip
27 Aug 25 at 2:27 am
MapleMeds Direct [url=https://maplemedsdirect.com/#]bartell drug store pharmacy hours[/url] MapleMeds Direct
KennethFax
27 Aug 25 at 8:45 am
mail order pharmacy no prescription: cheapest pharmacy to get concerta – MapleMeds Direct
Richardgor
27 Aug 25 at 8:57 am
BharatMeds Direct: online pharmacy india – BharatMeds Direct
Anthonypip
27 Aug 25 at 11:31 am
wood privacy fence installation Wood Post Price Pine and cedar are two popular options for posts and will vary.
Harveyrix
27 Aug 25 at 12:11 pm
Hi to every one, as I am actually eager of reading this web site’s post to be updated on a regular basis. It carries fastidious data.
https://geliosfireworks.com.ua/styokla-dlya-far-i-bezpeka-pishokhodiv.html
EarnestAbent
27 Aug 25 at 12:13 pm
x partners Pampadu Партнерская платформа, предлагающая продукты страхования и финансов с оплатой за действие.
Richardedite
27 Aug 25 at 1:26 pm
Please let me know if you’re looking for a article writer for your blog. You have some really great posts and I think I would be a good asset. If you ever want to take some of the load off, I’d love to write some content for your blog in exchange for a link back to mine. Please shoot me an email if interested. Regards!
https://http-kra38.cc/
OLaneDrync
27 Aug 25 at 4:35 pm
BharatMeds Direct [url=http://bharatmedsdirect.com/#]BharatMeds Direct[/url] online shopping pharmacy india
KennethFax
27 Aug 25 at 4:36 pm
обучение кайтсёрфингу
Jeromeensum
27 Aug 25 at 5:12 pm
Tizanidine [url=https://maplemedsdirect.shop/#]MapleMeds Direct[/url] acyclovir pharmacy online
KennethFax
27 Aug 25 at 5:36 pm
mexitil online pharmacy: top rx pharmacy – ultram us pharmacy
Haroldepife
27 Aug 25 at 7:54 pm
doxycycline boots pharmacy: MapleMeds Direct – MapleMeds Direct
Haroldepife
28 Aug 25 at 5:06 am
cooperative pharmacy store locator: clotrimazole price pharmacy – MapleMeds Direct
Anthonypip
28 Aug 25 at 5:47 am
MapleMeds Direct [url=http://maplemedsdirect.com/#]clindamycin target pharmacy[/url] pharmacy store usa
KennethFax
28 Aug 25 at 11:07 am
indian pharmacies safe: indian pharmacy online – BharatMeds Direct
Haroldepife
28 Aug 25 at 2:04 pm
BharatMeds Direct: BharatMeds Direct – BharatMeds Direct
Anthonypip
28 Aug 25 at 2:27 pm
https://share.evernote.com/note/2b302aa5-6286-e86c-ed38-7ef8f85e94d8
HarryBug
28 Aug 25 at 5:34 pm
indian pharmacy online: BharatMeds Direct – buy medicines online in india
Richardgor
28 Aug 25 at 5:46 pm
BharatMeds Direct [url=http://bharatmedsdirect.com/#]reputable indian pharmacies[/url] BharatMeds Direct
KennethFax
28 Aug 25 at 7:35 pm
NIS150-125-250G/22SWH Консольно-моноблочный насос Проточная часть и рабочее колесо – чугун HT200
DennisNeits
28 Aug 25 at 7:43 pm
indianpharmacy com: BharatMeds Direct – india pharmacy mail order
Haroldepife
28 Aug 25 at 7:44 pm
программа для учета путевых листов скачать Автопарк требует постоянного контроля. Программа для учета автопарка оптимизирует управление автопарком, контролирует расходы и обеспечивает безопасность перевозок.
Michaelphacy
28 Aug 25 at 8:27 pm
MapleMeds Direct: MapleMeds Direct – generic viagra us pharmacy
Anthonypip
28 Aug 25 at 11:00 pm
BharatMeds Direct: BharatMeds Direct – BharatMeds Direct
Richardgor
29 Aug 25 at 1:29 am
worldwide pharmacy kamagra [url=https://maplemedsdirect.shop/#]MapleMeds Direct[/url] dostinex online pharmacy
KennethFax
29 Aug 25 at 3:52 am
BharatMeds Direct: BharatMeds Direct – top online pharmacy india
Anthonypip
29 Aug 25 at 7:26 am
BharatMeds Direct: reputable indian pharmacies – india pharmacy mail order
Haroldepife
29 Aug 25 at 7:35 am
BharatMeds Direct [url=http://bharatmedsdirect.com/#]Online medicine order[/url] BharatMeds Direct
KennethFax
29 Aug 25 at 12:08 pm
http://bharatmedsdirect.com/# Online medicine home delivery
Patrickarons
29 Aug 25 at 1:20 pm
1win69: preman69 login tanpa ribet – preman69 login
Miltondep
29 Aug 25 at 4:36 pm
giocare da mobile a Starburst: starburst – migliori casino online con Starburst
LouisJoync
29 Aug 25 at 4:46 pm
https://github.com/msrds/Microsoft-Remote-Desktop
Jamesalurl
29 Aug 25 at 5:12 pm
bonus di benvenuto per Book of Ra Italia: Book of Ra Deluxe soldi veri – giri gratis Book of Ra Deluxe
Ramonatowl
29 Aug 25 at 5:16 pm
promosi dan bonus harian preman69 [url=https://1win69.shop/#]preman69 situs judi online 24 jam[/url] 1win69
Aaronreima
29 Aug 25 at 10:12 pm