Input validation with filter functions
Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.
Which are available?
Below a shameless copy paste of the PHP documentation.
- filter_has_var — Checks if variable of specified type exists
- filter_id — Returns the filter ID belonging to a named filter
- filter_input_array — Gets external variables and optionally filters them
- filter_input — Gets a specific external variable by name and optionally filters it
- filter_list — Returns a list of all supported filters
- filter_var_array — Gets multiple variables and optionally filters them
- filter_var — Filters a variable with a specified filter
Pratical use
Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.
Sanitizing a single variable
$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");
Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array
filter_var_array($_POST, FILTER_SANITIZE_STRING);
Validating an email address
if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
$this->addError('Invalid email address', $sEmail);
}
Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.
$aData = array(
'student' => 'Sjoerd Maessen',
'class' => '21',
'grades' => array(
'math' => 9,
'geography' => 66,
'gymnastics' => 7.5
)
);
$aValidation = array(
'student' => FILTER_SANITIZE_STRING,
'class' => FILTER_VALIDATE_INT,
'grades' => array(
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_FORCE_ARRAY,
'options'=> array('min_range'=>0, 'max_range'=>10))
);
echo '';
var_dump(filter_var_array($aData, $aValidation));
/*array(3) {
["student"]=>
string(14) "Sjoerd Maessen"
["class"]=>
int(21) // Thats strange, my string is converted
["grades"]=>
array(3) {
["math"]=>
int(9)
["geography"]=>
bool(false) // 66 is > 10
["gymnastics"]=>
bool(false) // 7.5 is not an int
}
}*/
Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider
Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links
Filter functions
Filter flags
http://medicosur.com/# mexican pharma
MervinWoorE
15 Oct 25 at 6:40 pm
bs2web at Заинтригован, что вызывает резонанс в тёмных закоулках сети? Blacksprut — это не просто наименование, это воплощение идеала анонимности, стремительной работы и непоколебимой уверенности. Отправляйся на bs2best.at — в обитель, где раскрывают секреты, о которых предпочитают молчать. Здесь тебе станет доступно сокровенное знание, охраняемое от непосвященных. Исключительно для тех, кто понимает суть. Никаких улик. Никаких соглашений. Только Blacksprut. Не упусти драгоценную возможность стать пионером — bs2best.at распахнул врата для тех, кто ищет истину. Хватит ли тебе отваги заглянуть правде в лицо?
HermanRhype
15 Oct 25 at 7:07 pm
https://t.me/s/Official_1xbet_1xbet
Josephtog
15 Oct 25 at 7:34 pm
Строительный портал https://v-stroit.ru всё о строительстве, ремонте и архитектуре. Полезные советы, технологии, материалы, новости отрасли и практические инструкции для мастеров и новичков.
Rogerzok
15 Oct 25 at 7:50 pm
https://t.me/s/rating_online/13
EverettGuemn
15 Oct 25 at 9:07 pm
https://t.me/s/rating_online/5
EverettGuemn
15 Oct 25 at 9:07 pm
https://t.me/rating_online
EverettGuemn
15 Oct 25 at 9:09 pm
https://t.me/rating_online/9
EverettGuemn
15 Oct 25 at 9:22 pm
https://t.me/s/rating_online
EverettGuemn
15 Oct 25 at 10:07 pm
https://t.me/rating_online/13
EverettGuemn
15 Oct 25 at 10:22 pm
https://t.me/rating_online/5
EverettGuemn
15 Oct 25 at 10:33 pm
online pharmacy: trusted online pharmacy USA – safe online medication store
AndrewPal
15 Oct 25 at 10:37 pm
https://t.me/s/rating_online/2
EverettGuemn
15 Oct 25 at 10:47 pm
Строительный портал https://v-stroit.ru всё о строительстве, ремонте и архитектуре. Полезные советы, технологии, материалы, новости отрасли и практические инструкции для мастеров и новичков.
Rogerzok
15 Oct 25 at 10:57 pm
https://t.me/rating_online/2
EverettGuemn
15 Oct 25 at 11:22 pm
https://t.me/rating_online/4
EverettGuemn
15 Oct 25 at 11:23 pm
https://t.me/s/rating_online/1
EverettGuemn
15 Oct 25 at 11:46 pm
https://t.me/s/rating_online/7
EverettGuemn
15 Oct 25 at 11:47 pm
https://t.me/rating_online/3
EverettGuemn
16 Oct 25 at 12:11 am
backstage updates
MichaelSig
16 Oct 25 at 12:16 am
https://t.me/rating_online/6
EverettGuemn
16 Oct 25 at 12:25 am
trusted online pharmacy USA [url=https://zencaremeds.com/#]buy propecia[/url] ZenCareMeds
CareyMag
16 Oct 25 at 12:34 am
Риэлторская контора https://daber27.ru покупка, продажа и аренда недвижимости. Помогаем оформить сделки безопасно и выгодно. Опытные риэлторы, консультации, сопровождение и проверка документов.
ErnestAroms
16 Oct 25 at 12:35 am
Купольные дома https://kupol-doma.ru под ключ — энергоэффективные, надёжные и современные. Проектирование, строительство и отделка. Уникальная архитектура, комфорт и долговечность в каждом доме.
Johnnymic
16 Oct 25 at 12:35 am
https://t.me/s/rating_online/4
EverettGuemn
16 Oct 25 at 1:02 am
https://t.me/s/rating_online/6
EverettGuemn
16 Oct 25 at 1:26 am
http://medicosur.com/# mexico pharmacy list
Hermandug
16 Oct 25 at 1:34 am
buy Doxycycline: buy Doxycycline – buy propecia
Andresstold
16 Oct 25 at 1:35 am
https://t.me/s/rating_online/8
EverettGuemn
16 Oct 25 at 1:53 am
http://medicosur.com/# MedicoSur
MervinWoorE
16 Oct 25 at 1:58 am
Риэлторская контора https://daber27.ru покупка, продажа и аренда недвижимости. Помогаем оформить сделки безопасно и выгодно. Опытные риэлторы, консультации, сопровождение и проверка документов.
ErnestAroms
16 Oct 25 at 2:12 am
Купольные дома https://kupol-doma.ru под ключ — энергоэффективные, надёжные и современные. Проектирование, строительство и отделка. Уникальная архитектура, комфорт и долговечность в каждом доме.
Johnnymic
16 Oct 25 at 2:14 am
Ваша Недвижимость https://rbn-khv.ru сайт о покупке, продаже и аренде жилья. Разбираем сделки, налоги, ипотеку и инвестиции. Полезная информация для владельцев и покупателей недвижимости.
GonzaloMox
16 Oct 25 at 3:29 am
Информационный блог https://gidroekoproekt.ru для инженеров и проектировщиков. Всё об инженерных изысканиях, водохозяйственных объектах, гидротехническом строительстве и современных технологиях в отрасли.
ThomasGer
16 Oct 25 at 3:31 am
Информационный блог https://gidroekoproekt.ru для инженеров и проектировщиков. Всё об инженерных изысканиях, водохозяйственных объектах, гидротехническом строительстве и современных технологиях в отрасли.
ThomasGer
16 Oct 25 at 5:08 am
Ваша Недвижимость https://rbn-khv.ru сайт о покупке, продаже и аренде жилья. Разбираем сделки, налоги, ипотеку и инвестиции. Полезная информация для владельцев и покупателей недвижимости.
GonzaloMox
16 Oct 25 at 5:10 am
affordable Cialis with fast delivery: TadaLife Pharmacy – affordable Cialis with fast delivery
AndrewPal
16 Oct 25 at 5:30 am
https://pikman.info/ What we do I lead a powerful team that is shaping the future of B2B Saas go-to-market strategies. My company Pikman.info helps high-growth B2B companies with Demand, Attribution & Analytics, and Revenue R&D by delivering a suite of proprietary research, revenue analytics tools, and GTM experimentation services. Pikman.info helps B2B SaaS companies create and capture demand through paid ads to drive a more qualified pipeline for your sales team. Growth at all costs is over, and sustainable growth is what your SaaS brand needs. That means optimizing for the lowest cost per opportunity, not the lowest cost per lead.
Williamscach
16 Oct 25 at 6:58 am
https://t.me/Online_1_xbet/2009
CharlesCic
16 Oct 25 at 8:29 am
https://t.me/Online_1_xbet/3509
CharlesCic
16 Oct 25 at 8:30 am
https://t.me/Online_1_xbet/2940
CharlesCic
16 Oct 25 at 8:31 am
https://t.me/Online_1_xbet/3127
CharlesCic
16 Oct 25 at 8:45 am
https://t.me/Online_1_xbet/2350
CharlesCic
16 Oct 25 at 8:57 am
https://t.me/Online_1_xbet/3368
CharlesCic
16 Oct 25 at 8:58 am
https://t.me/Online_1_xbet/1902
CharlesCic
16 Oct 25 at 8:59 am
ZenCare Meds [url=https://zencaremeds.com/#]best canadian online pharmacy[/url] american online pharmacy
CareyMag
16 Oct 25 at 9:05 am
https://t.me/Online_1_xbet/2273
CharlesCic
16 Oct 25 at 9:12 am
https://t.me/Online_1_xbet/3251
CharlesCic
16 Oct 25 at 9:23 am
https://t.me/Online_1_xbet/2946
CharlesCic
16 Oct 25 at 9:24 am
https://t.me/Online_1_xbet/3582
CharlesCic
16 Oct 25 at 9:26 am