Input validation with filter functions

Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.

Which are available?
Below a shameless copy paste of the PHP documentation.

filter_has_var — Checks if variable of specified type exists
filter_id — Returns the filter ID belonging to a named filter
filter_input_array — Gets external variables and optionally filters them
filter_input — Gets a specific external variable by name and optionally filters it
filter_list — Returns a list of all supported filters
filter_var_array — Gets multiple variables and optionally filters them
filter_var — Filters a variable with a specified filter

Pratical use

Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.

Sanitizing a single variable

$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");

Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array

filter_var_array($_POST, FILTER_SANITIZE_STRING);

Validating an email address

if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
     $this->addError('Invalid email address', $sEmail);
}

Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.

$aData = array(
	'student'	=> 'Sjoerd Maessen',
	'class'		=> '21',
	'grades' => array(
			'math' => 9,
			'geography' => 66,
			'gymnastics' => 7.5
	)
);

$aValidation = array(
	'student'	=> FILTER_SANITIZE_STRING,
	'class'		=> FILTER_VALIDATE_INT,
	'grades'	=> array(
				'filter' => FILTER_VALIDATE_INT,
				'flags'	 => FILTER_FORCE_ARRAY,
				'options'=> array('min_range'=>0, 'max_range'=>10))
);

echo '';
var_dump(filter_var_array($aData, $aValidation));

/*array(3) {
  ["student"]=>
  string(14) "Sjoerd Maessen"
  ["class"]=>
  int(21) // Thats strange, my string is converted
  ["grades"]=>
  array(3) {
    ["math"]=>
    int(9)
    ["geography"]=>
    bool(false) // 66 is > 10
    ["gymnastics"]=>
    bool(false) // 7.5 is not an int
  }
}*/

Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider

Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links

Filter functions

Filter flags

Written by Sjoerd Maessen

June 3rd, 2010 at 8:27 am

Posted in Security

Tagged with filter, sanitizing, validating

3,170 Responses to 'Input validation with filter functions'

Subscribe to comments with RSS or TrackBack to 'Input validation with filter functions'.

https://t.me/ud_Irwin/54

MichaelPione

31 Oct 25 at 4:41 am
Kamagra 100mg prix France: Kamagra pas cher France – kamagra

RobertJuike

31 Oct 25 at 5:01 am
https://t.me/s/ud_Pin_Up/48

MichaelPione

31 Oct 25 at 5:16 am
Kamagra online kaufen: diskrete Lieferung per DHL – vital pharma 24

ThomasCep

31 Oct 25 at 5:35 am
http://farmaciavivait.com/# FarmaciaViva

Davidjealp

31 Oct 25 at 5:36 am
https://t.me/s/ud_JoyCasino/47

MichaelPione

31 Oct 25 at 5:49 am
https://t.me/s/ud_Leon/52

MichaelPione

31 Oct 25 at 5:51 am
https://t.me/s/ud_Daddy/64

MichaelPione

31 Oct 25 at 5:56 am
Kamagra sans ordonnance: Kamagra 100mg prix France – Vita Homme

RobertJuike

31 Oct 25 at 6:22 am
Un Code promo 1xbet 2026 : obtenez un bonus de bienvenue de 100% sur votre premier depot avec un bonus allant jusqu’a 130 €. Jouez et placez vos paris facilement grace aux fonds bonus. Apres l’inscription, il est important de recharger votre compte. Si votre compte est verifie, vous pourrez retirer toutes les sommes d’argent, y compris les bonus. Le code promo 1xbet est disponible via ce lien : https://lojadecorreias.com.br/pages/le-code-promo-1xbet_bonus.html.

Domingobuisy

31 Oct 25 at 6:28 am
https://t.me/ud_JoyCasino/57

MichaelPione

31 Oct 25 at 6:31 am
Kamagra online kaufen: Potenzmittel ohne ärztliches Rezept – diskrete Lieferung per DHL

RichardImmon

31 Oct 25 at 6:52 am
https://t.me/ud_Booi/44

MichaelPione

31 Oct 25 at 7:03 am
vitalpharma24: vitalpharma24 – Kamagra Wirkung und Nebenwirkungen

ThomasCep

31 Oct 25 at 7:04 am
https://t.me/s/ud_1xSlots/47

MichaelPione

31 Oct 25 at 7:10 am
acquistare Spedra online: acquistare Spedra online – Avanafil senza ricetta

ClydeExamp

31 Oct 25 at 7:34 am
https://t.me/ud_Legzo/62

MichaelPione

31 Oct 25 at 7:45 am
https://t.me/ud_Daddy/64

MichaelPione

31 Oct 25 at 8:16 am
https://t.me/s/?ud_1Go/46

MichaelPione

31 Oct 25 at 8:19 am
https://t.me/ud_Flagman/50

MichaelPione

31 Oct 25 at 8:23 am
https://t.me/ud_Casino_X/58

MichaelPione

31 Oct 25 at 9:00 am
Le code promo est supprime : entrez-le dans le champ « Code promo » et reclamez un bonus de bienvenue de 100% jusqu’a 130€, pour vos paris sportifs. Vous pouvez vous inscrire sur le site 1xBet ou via l’application mobile. Apres votre premier depot, vous activerez le code bonus. L’offre est valable pour toute l’annee 2026, et le bonus doit etre mise dans les 30 jours. Vous pouvez trouver le code promo sur ce lien : https://ledigital.com/wp-content/pages/?code_promo_179.html.

Domingobuisy

31 Oct 25 at 9:17 am
trusted online pharmacy Ireland: online pharmacy – online pharmacy ireland

HaroldSHems

31 Oct 25 at 9:31 am
https://t.me/ud_PlayFortuna/49

MichaelPione

31 Oct 25 at 9:33 am
https://t.me/ud_Kometa/45

MichaelPione

31 Oct 25 at 9:35 am
https://t.me/s/ud_Martin/53

MichaelPione

31 Oct 25 at 9:41 am
discount pharmacies in Ireland [url=http://irishpharmafinder.com/#]discount pharmacies in Ireland[/url] buy medicine online legally Ireland

Hermanengam

31 Oct 25 at 9:43 am
https://ukmedsguide.shop/# safe place to order meds UK

Haroldovaph

31 Oct 25 at 9:54 am
https://t.me/s/ud_Irwin/54

MichaelPione

31 Oct 25 at 10:18 am
Australian pharmacy reviews: Australian pharmacy reviews – Aussie Meds Hub

Johnnyfuede

31 Oct 25 at 10:46 am
https://t.me/s/ud_Starda/52

MichaelPione

31 Oct 25 at 10:52 am
https://t.me/ud_Gizbo/60

MichaelPione

31 Oct 25 at 10:55 am
https://t.me/ud_JoyCasino/50

MichaelPione

31 Oct 25 at 11:00 am
https://t.me/s/ud_Drip/49

MichaelPione

31 Oct 25 at 11:37 am
best Irish pharmacy websites

Edmundexpon

31 Oct 25 at 11:43 am
best pharmacy sites with discounts: buy medications online safely – best pharmacy sites with discounts

Johnnyfuede

31 Oct 25 at 11:51 am
https://t.me/ud_Pinco/50

MichaelPione

31 Oct 25 at 12:12 pm
https://t.me/ud_Starda/49

MichaelPione

31 Oct 25 at 12:15 pm
https://t.me/s/ud_JoyCasino/51

MichaelPione

31 Oct 25 at 12:20 pm
pharmacy discount codes AU: Aussie Meds Hub – Australian pharmacy reviews

HaroldSHems

31 Oct 25 at 12:33 pm
Irish Pharma Finder [url=https://irishpharmafinder.com/#]online pharmacy ireland[/url] online pharmacy

Hermanengam

31 Oct 25 at 12:54 pm
Irish Pharma Finder

Edmundexpon

31 Oct 25 at 12:54 pm
https://t.me/s/ud_1xbet/45

MichaelPione

31 Oct 25 at 12:59 pm
https://t.me/s/ud_Pokerdom/50

MichaelPione

31 Oct 25 at 1:32 pm
https://t.me/s/ud_Kent/44

MichaelPione

31 Oct 25 at 1:35 pm
https://t.me/ud_Legzo/54

MichaelPione

31 Oct 25 at 1:40 pm
best Australian pharmacies: best Australian pharmacies – Aussie Meds Hub Australia

HaroldSHems

31 Oct 25 at 1:42 pm
https://t.me/ud_Rox/58

MichaelPione

31 Oct 25 at 2:17 pm
Uk Meds Guide [url=http://ukmedsguide.com/#]safe place to order meds UK[/url] UkMedsGuide

Hermanengam

31 Oct 25 at 2:30 pm
https://t.me/s/ud_Martin/57

MichaelPione

31 Oct 25 at 2:52 pm

Pokertoernooi holland casino Groningen

Casino spel echt geld

Krasloten nationale loterij

Sjoerd Maessen blog

Input validation with filter functions

3,170 Responses to 'Input validation with filter functions'

Leave a Reply

Archive

Recent Comments

Tags

Meta