Input validation with filter functions
Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.
Which are available?
Below a shameless copy paste of the PHP documentation.
- filter_has_var — Checks if variable of specified type exists
- filter_id — Returns the filter ID belonging to a named filter
- filter_input_array — Gets external variables and optionally filters them
- filter_input — Gets a specific external variable by name and optionally filters it
- filter_list — Returns a list of all supported filters
- filter_var_array — Gets multiple variables and optionally filters them
- filter_var — Filters a variable with a specified filter
Pratical use
Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.
Sanitizing a single variable
$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");
Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array
filter_var_array($_POST, FILTER_SANITIZE_STRING);
Validating an email address
if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
$this->addError('Invalid email address', $sEmail);
}
Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.
$aData = array(
'student' => 'Sjoerd Maessen',
'class' => '21',
'grades' => array(
'math' => 9,
'geography' => 66,
'gymnastics' => 7.5
)
);
$aValidation = array(
'student' => FILTER_SANITIZE_STRING,
'class' => FILTER_VALIDATE_INT,
'grades' => array(
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_FORCE_ARRAY,
'options'=> array('min_range'=>0, 'max_range'=>10))
);
echo '';
var_dump(filter_var_array($aData, $aValidation));
/*array(3) {
["student"]=>
string(14) "Sjoerd Maessen"
["class"]=>
int(21) // Thats strange, my string is converted
["grades"]=>
array(3) {
["math"]=>
int(9)
["geography"]=>
bool(false) // 66 is > 10
["gymnastics"]=>
bool(false) // 7.5 is not an int
}
}*/
Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider
Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links
Filter functions
Filter flags
Je trouve absolument barge Madnix Casino, ca degage une vibe de jeu completement demente. La selection du casino est une veritable explosion de fun, incluant des jeux de table de casino pleins de panache. Le personnel du casino offre un accompagnement qui fait des etincelles, joignable par chat ou email. Les gains du casino arrivent a une vitesse supersonique, parfois des recompenses de casino supplementaires feraient disjoncter. En somme, Madnix Casino promet un divertissement de casino totalement barge pour ceux qui cherchent l’adrenaline demente du casino ! De surcroit la plateforme du casino brille par son style completement fou, facilite une experience de casino electrisante.
all games madnix|
funkygecko3zef
9 Sep 25 at 10:50 am
https://intimacareuk.com/# buy ED pills online discreetly UK
Miltonbus
9 Sep 25 at 1:14 pm
viagra discreet delivery UK https://bluepilluk.shop/# BluePill UK
StuartDop
9 Sep 25 at 2:03 pm
fast delivery viagra UK online: fast delivery viagra UK online – viagra online UK no prescription
Jamesmit
9 Sep 25 at 5:51 pm
sildenafil tablets online order UK [url=https://bluepilluk.com/#]BluePillUK[/url] viagra discreet delivery UK
Albertmoone
9 Sep 25 at 6:02 pm
https://meditrustuk.shop/# generic stromectol UK delivery
Carrollalery
9 Sep 25 at 6:32 pm
http://intimacareuk.com/# cialis online UK no prescription
Miltonbus
9 Sep 25 at 8:51 pm
Acho simplesmente brabissimo MegaPosta Casino, tem uma vibe de jogo que e pura dinamite. Os titulos do cassino sao um espetaculo insano, com slots de cassino unicos e contagiantes. O suporte do cassino ta sempre na ativa 24/7, acessivel por chat ou e-mail. As transacoes do cassino sao simples como um estalo, mas mais bonus regulares no cassino seria brabo. Na real, MegaPosta Casino e um cassino online que e um vulcao de diversao para os viciados em emocoes de cassino! Vale falar tambem a interface do cassino e fluida e cheia de energia explosiva, da um toque de classe braba ao cassino.
megaposta login|
whackypenguin6zef
9 Sep 25 at 9:06 pm
Je suis accro a MyStake Casino, c’est un casino en ligne qui intrigue comme un grimoire ancien. Les options de jeu au casino sont riches et intrigantes, avec des machines a sous de casino modernes et envoutantes. Les agents du casino sont rapides comme une vision prophetique, offrant des solutions claires et instantanees. Les retraits au casino sont rapides comme une revelation, cependant plus de tours gratuits au casino ce serait mystique. Globalement, MyStake Casino est un casino en ligne qui intrigue comme un manuscrit ancien pour les explorateurs des mysteres du casino ! Bonus le site du casino est une merveille graphique mysterieuse, facilite une experience de casino mystique.
como desactivar un bono en mystake|
fluffymantis7zef
9 Sep 25 at 9:10 pm
Sou viciado no role de OshCasino, e um cassino online que detona como um vulcao. Os titulos do cassino sao um espetaculo vulcanico, com caca-niqueis de cassino modernos e eletrizantes. Os agentes do cassino sao rapidos como um estalo, dando solucoes na hora e com precisao. As transacoes do cassino sao simples como uma brisa, mas queria mais promocoes de cassino que incendeiam. No fim das contas, OshCasino oferece uma experiencia de cassino que e puro fogo para os amantes de cassinos online! E mais o site do cassino e uma obra-prima de estilo, o que deixa cada sessao de cassino ainda mais incendiaria.
osh 5|
zestylizard7zef
9 Sep 25 at 9:15 pm
Ich finde absolut uberwaltigend Platin Casino, es ist ein Online-Casino, das wie ein Edelstein strahlt. Die Auswahl im Casino ist ein echtes Meisterwerk, mit Live-Casino-Sessions, die wie ein Diamant leuchten. Die Casino-Mitarbeiter sind schnell wie ein Lichtstrahl, liefert klare und schnelle Losungen. Casino-Transaktionen sind simpel wie ein Edelstein, aber die Casino-Angebote konnten gro?zugiger sein. Am Ende ist Platin Casino ein Online-Casino, das wie ein Schatz strahlt fur Fans moderner Casino-Slots! Extra die Casino-Plattform hat einen Look, der wie Platin strahlt, einen Hauch von Glanz ins Casino bringt.
platin casino – بلاتين كازينو|
sparklynewt6zef
9 Sep 25 at 9:18 pm
Ich finde absolut verruckt Pledoo Casino, es ist ein Online-Casino, das wie ein Wirbelwind tobt. Es gibt eine Woge an packenden Casino-Titeln, mit einzigartigen Casino-Slotmaschinen. Das Casino-Team bietet Unterstutzung, die wie ein Stern funkelt, mit Hilfe, die wie ein Funke spruht. Auszahlungen im Casino sind schnell wie ein Sturm, aber wurde ich mir mehr Casino-Promos wunschen, die wie ein Vulkan ausbrechen. Alles in allem ist Pledoo Casino ein Muss fur Casino-Fans fur Fans von Online-Casinos! Ubrigens die Casino-Navigation ist kinderleicht wie ein Windhauch, Lust macht, immer wieder ins Casino zuruckzukehren.
pledoo casino gr|
whimsyslug8zef
9 Sep 25 at 9:20 pm
generic sildenafil UK pharmacy https://bluepilluk.shop/# generic sildenafil UK pharmacy
StuartDop
9 Sep 25 at 9:23 pm
IntimaCare UK: buy ED pills online discreetly UK – confidential delivery cialis UK
Jamesmit
10 Sep 25 at 12:34 am
ivermectin without prescription UK [url=https://meditrustuk.shop/#]MediTrustUK[/url] stromectol pills home delivery UK
Albertmoone
10 Sep 25 at 1:07 am