Input validation with filter functions
Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.
Which are available?
Below a shameless copy paste of the PHP documentation.
- filter_has_var — Checks if variable of specified type exists
- filter_id — Returns the filter ID belonging to a named filter
- filter_input_array — Gets external variables and optionally filters them
- filter_input — Gets a specific external variable by name and optionally filters it
- filter_list — Returns a list of all supported filters
- filter_var_array — Gets multiple variables and optionally filters them
- filter_var — Filters a variable with a specified filter
Pratical use
Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.
Sanitizing a single variable
$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");
Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array
filter_var_array($_POST, FILTER_SANITIZE_STRING);
Validating an email address
if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
$this->addError('Invalid email address', $sEmail);
}
Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.
$aData = array(
'student' => 'Sjoerd Maessen',
'class' => '21',
'grades' => array(
'math' => 9,
'geography' => 66,
'gymnastics' => 7.5
)
);
$aValidation = array(
'student' => FILTER_SANITIZE_STRING,
'class' => FILTER_VALIDATE_INT,
'grades' => array(
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_FORCE_ARRAY,
'options'=> array('min_range'=>0, 'max_range'=>10))
);
echo '';
var_dump(filter_var_array($aData, $aValidation));
/*array(3) {
["student"]=>
string(14) "Sjoerd Maessen"
["class"]=>
int(21) // Thats strange, my string is converted
["grades"]=>
array(3) {
["math"]=>
int(9)
["geography"]=>
bool(false) // 66 is > 10
["gymnastics"]=>
bool(false) // 7.5 is not an int
}
}*/
Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider
Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links
Filter functions
Filter flags
https://t.me/ud_Vulkan/53
MichaelPione
31 Oct 25 at 10:38 pm
https://t.me/s/ud_Jet/46
MichaelPione
31 Oct 25 at 10:40 pm
https://t.me/s/ud_Vulkan/50
MichaelPione
31 Oct 25 at 10:45 pm
https://t.me/s/ud_Pin_Up/49
MichaelPione
31 Oct 25 at 11:20 pm
trusted online pharmacy USA [url=https://safemedsguide.com/#]best online pharmacy[/url] compare online pharmacy prices
Hermanengam
31 Oct 25 at 11:51 pm
https://t.me/ud_Rox/48
MichaelPione
31 Oct 25 at 11:52 pm
https://t.me/ud_PlayFortuna/53
MichaelPione
31 Oct 25 at 11:55 pm
https://t.me/ud_Vulkan/44
MichaelPione
31 Oct 25 at 11:59 pm
https://safemedsguide.shop/# top rated online pharmacies
Haroldovaph
1 Nov 25 at 12:34 am
online pharmacy: trusted online pharmacy UK – affordable medications UK
Johnnyfuede
1 Nov 25 at 12:35 am
https://t.me/ud_Irwin/57
MichaelPione
1 Nov 25 at 12:36 am
trusted online pharmacy Ireland: Irish online pharmacy reviews – discount pharmacies in Ireland
HaroldSHems
1 Nov 25 at 12:46 am
https://t.me/s/Beefcasino_rus/59
RouletteRogue
1 Nov 25 at 12:48 am
https://t.me/Beefcasino_rus/59
RouletteRogue
1 Nov 25 at 12:53 am
https://t.me/s/Beefcasino_rus/59
LuckyBandit
1 Nov 25 at 1:03 am
https://t.me/s/ud_Leon/56
MichaelPione
1 Nov 25 at 1:07 am
https://t.me/ud_Gama/44
MichaelPione
1 Nov 25 at 1:09 am
https://t.me/ud_Jet/50
MichaelPione
1 Nov 25 at 1:14 am
Safe Meds Guide: online pharmacy reviews and ratings – online pharmacy
Johnnyfuede
1 Nov 25 at 1:34 am
pharmacy delivery Ireland
Edmundexpon
1 Nov 25 at 1:39 am
https://t.me/s/ud_Stake/52
MichaelPione
1 Nov 25 at 1:51 am
compare online pharmacy prices: compare online pharmacy prices – online pharmacy reviews and ratings
HaroldSHems
1 Nov 25 at 1:51 am
https://t.me/Beefcasino_rus/59
LuckyBandit
1 Nov 25 at 2:19 am
https://t.me/ud_Pokerdom/62
MichaelPione
1 Nov 25 at 2:25 am
https://t.me/s/ud_Daddy/50
MichaelPione
1 Nov 25 at 2:27 am
https://t.me/s/ud_Kometa/60
MichaelPione
1 Nov 25 at 2:32 am
top-rated pharmacies in Ireland
Edmundexpon
1 Nov 25 at 2:45 am
buy medicine online legally Ireland [url=http://irishpharmafinder.com/#]discount pharmacies in Ireland[/url] Irish online pharmacy reviews
Hermanengam
1 Nov 25 at 2:47 am
http://irishpharmafinder.com/# online pharmacy
Haroldovaph
1 Nov 25 at 2:51 am
https://t.me/s/ud_DragonMoney/51
MichaelPione
1 Nov 25 at 3:08 am
https://t.me/s/ud_Pokerdom/63
MichaelPione
1 Nov 25 at 3:39 am
https://t.me/s/ud_Vulkan/64
MichaelPione
1 Nov 25 at 3:46 am
affordable medications UK [url=https://ukmedsguide.shop/#]UkMedsGuide[/url] online pharmacy
Hermanengam
1 Nov 25 at 4:17 am
https://t.me/ud_Stake/49
MichaelPione
1 Nov 25 at 4:19 am
discount pharmacies in Ireland: trusted online pharmacy Ireland – top-rated pharmacies in Ireland
HaroldSHems
1 Nov 25 at 4:42 am
https://t.me/ud_CatCasino/60
MichaelPione
1 Nov 25 at 4:50 am
https://t.me/s/ud_Riobet/61
MichaelPione
1 Nov 25 at 4:52 am
best pharmacy sites with discounts: trusted online pharmacy USA – compare online pharmacy prices
Johnnyfuede
1 Nov 25 at 4:55 am
https://t.me/ud_Daddy/49
MichaelPione
1 Nov 25 at 4:56 am
https://t.me/ud_Starda/53
MichaelPione
1 Nov 25 at 5:32 am
SafeMedsGuide: cheapest pharmacies in the USA – online pharmacy
HaroldSHems
1 Nov 25 at 6:00 am
https://t.me/s/ud_Riobet/44
MichaelPione
1 Nov 25 at 6:02 am
https://t.me/s/ud_Jet/57
MichaelPione
1 Nov 25 at 6:05 am
Uk Meds Guide: safe place to order meds UK – legitimate pharmacy sites UK
Johnnyfuede
1 Nov 25 at 6:07 am
https://t.me/s/ud_PlayFortuna/47
MichaelPione
1 Nov 25 at 6:09 am
Irish Pharma Finder
Edmundexpon
1 Nov 25 at 6:21 am
Galera, vim dividir minhas impressoes no 4PlayBet Casino porque me pegou de surpresa. A variedade de jogos e simplesmente incrivel: jogos ao vivo imersivos, todos funcionando perfeito. O suporte foi atencioso, responderam em minutos pelo chat, algo que faz diferenca. Fiz saque em cartao e o dinheiro entrou na mesma hora, ponto fortissimo. Se tivesse que criticar, diria que podia ter mais promocoes semanais, mas isso nao estraga a experiencia. Pra concluir, o 4PlayBet Casino tem diferencial real. Vale experimentar.
4play ayia napa|
neonfalcon88zef
1 Nov 25 at 6:22 am
https://t.me/s/ud_MostBet/63
MichaelPione
1 Nov 25 at 6:45 am
Ich schatze die Spannung bei Cat Spins Casino, es sorgt fur pure Unterhaltung. Es gibt unzahlige packende Spiele, mit Spielen, die Krypto unterstutzen. 100 % bis zu 500 € mit Freispielen. Der Service ist einwandfrei. Auszahlungen sind schnell und reibungslos, gelegentlich mehr regelma?ige Aktionen waren toll. Im Gro?en und Ganzen, Cat Spins Casino ist ein absolutes Highlight. Zusatzlich die Navigation ist einfach und klar, das Spielerlebnis steigert. Ein tolles Feature die vielfaltigen Wettmoglichkeiten, die die Community enger zusammenschwei?en.
Zum Ansehen klicken|
sonicpowerik6zef
1 Nov 25 at 6:59 am
Ich bin beeindruckt von SpinBetter Casino, es fuhlt sich an wie ein Strudel aus Freude. Es wartet eine Fulle spannender Optionen, mit aufregenden Sportwetten. Der Kundenservice ist ausgezeichnet, bietet klare Losungen. Die Auszahlungen sind ultraschnell, obwohl mehr Rewards waren ein Plus. Zusammengefasst, SpinBetter Casino ist absolut empfehlenswert fur Adrenalin-Sucher ! Zusatzlich die Site ist schnell und stylish, erleichtert die gesamte Erfahrung. Hervorzuheben ist die schnellen Einzahlungen, die Flexibilitat bieten.
https://spinbettercasino.de/|
SpinMasterZ7zef
1 Nov 25 at 7:08 am