Input validation with filter functions
Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.
Which are available?
Below a shameless copy paste of the PHP documentation.
- filter_has_var — Checks if variable of specified type exists
- filter_id — Returns the filter ID belonging to a named filter
- filter_input_array — Gets external variables and optionally filters them
- filter_input — Gets a specific external variable by name and optionally filters it
- filter_list — Returns a list of all supported filters
- filter_var_array — Gets multiple variables and optionally filters them
- filter_var — Filters a variable with a specified filter
Pratical use
Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.
Sanitizing a single variable
$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");
Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array
filter_var_array($_POST, FILTER_SANITIZE_STRING);
Validating an email address
if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
$this->addError('Invalid email address', $sEmail);
}
Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.
$aData = array(
'student' => 'Sjoerd Maessen',
'class' => '21',
'grades' => array(
'math' => 9,
'geography' => 66,
'gymnastics' => 7.5
)
);
$aValidation = array(
'student' => FILTER_SANITIZE_STRING,
'class' => FILTER_VALIDATE_INT,
'grades' => array(
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_FORCE_ARRAY,
'options'=> array('min_range'=>0, 'max_range'=>10))
);
echo '';
var_dump(filter_var_array($aData, $aValidation));
/*array(3) {
["student"]=>
string(14) "Sjoerd Maessen"
["class"]=>
int(21) // Thats strange, my string is converted
["grades"]=>
array(3) {
["math"]=>
int(9)
["geography"]=>
bool(false) // 66 is > 10
["gymnastics"]=>
bool(false) // 7.5 is not an int
}
}*/
Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider
Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links
Filter functions
Filter flags
https://t.me/s/ud_Vodka/28
MichaelPione
1 Nov 25 at 4:06 pm
online pharmacy: best UK pharmacy websites – affordable medications UK
Johnnyfuede
1 Nov 25 at 4:08 pm
https://t.me/ud_Riobet/19
MichaelPione
1 Nov 25 at 4:11 pm
rorzy7
📑 SECURITY ALERT; Unauthorized transaction of 0.9 Bitcoin. Cancel? >> https://graph.org/Binancecom-10-09?hs=1c988338b2d81320bb388cb9065e9bd7& 📑
1 Nov 25 at 4:11 pm
best pharmacy sites with discounts: top rated online pharmacies – buy medications online safely
HaroldSHems
1 Nov 25 at 4:53 pm
https://t.me/s/uD_MOSTBEt
MichaelPione
1 Nov 25 at 5:04 pm
https://t.me/s/Beefcasino_rus
MichaelPione
1 Nov 25 at 5:06 pm
https://t.me/s/UD_lex
MichaelPione
1 Nov 25 at 5:11 pm
Ich bin beeindruckt von der Qualitat bei Cat Spins Casino, es ist ein Hotspot fur Spielspa?. Es gibt eine riesige Vielfalt an Spielen, mit eleganten Tischspielen. 100 % bis zu 500 € plus Freispiele. Erreichbar 24/7 per Chat oder E-Mail. Auszahlungen sind blitzschnell, dennoch haufigere Promos wurden begeistern. Insgesamt, Cat Spins Casino ist ein absolutes Highlight. Au?erdem ist das Design stilvoll und modern, zum Weiterspielen animiert. Ein starker Vorteil sind die zuverlassigen Krypto-Zahlungen, individuelle Vorteile liefern.
Fakten entdecken|
brightbyteex4zef
1 Nov 25 at 5:12 pm
online pharmacy: compare online pharmacy prices – online pharmacy reviews and ratings
Johnnyfuede
1 Nov 25 at 5:26 pm
https://t.me/s/ud_1XsLOtS
MichaelPione
1 Nov 25 at 5:48 pm
Irish Pharma Finder
Edmundexpon
1 Nov 25 at 5:52 pm
https://t.me/s/ud_StaKe
MichaelPione
1 Nov 25 at 6:21 pm
https://t.me/s/UD_PlAYfoRtuNA
MichaelPione
1 Nov 25 at 6:28 pm
https://t.me/s/Ud_catcasINo
MichaelPione
1 Nov 25 at 7:05 pm
discount pharmacies in Ireland
Edmundexpon
1 Nov 25 at 7:21 pm
promo codes for online drugstores [url=https://safemedsguide.com/#]top rated online pharmacies[/url] Safe Meds Guide
Hermanengam
1 Nov 25 at 7:29 pm
https://t.me/s/uD_ggbET
MichaelPione
1 Nov 25 at 7:37 pm
https://t.me/s/UD_iRWIn
MichaelPione
1 Nov 25 at 7:39 pm
https://t.me/s/ud_JoycaSino
MichaelPione
1 Nov 25 at 7:44 pm
cheap medicines online Australia: Australian pharmacy reviews – Aussie Meds Hub Australia
HaroldSHems
1 Nov 25 at 8:47 pm
https://t.me/s/ud_MarTin
MichaelPione
1 Nov 25 at 8:52 pm
https://t.me/s/uD_stArda
MichaelPione
1 Nov 25 at 9:24 pm
buy medications online safely [url=https://safemedsguide.shop/#]trusted online pharmacy USA[/url] top rated online pharmacies
Hermanengam
1 Nov 25 at 9:28 pm
Je suis totalement seduit par 7BitCasino, c’est une veritable aventure pleine de sensations. Le catalogue est incroyablement vaste, comprenant plus de 5 000 jeux, dont 4 000 adaptes aux cryptomonnaies. Les agents sont disponibles 24/7, avec un suivi de qualite. Les transactions en cryptomonnaies sont instantanees, neanmoins les bonus pourraient etre plus reguliers, comme des offres de cashback plus avantageuses. En resume, 7BitCasino est un incontournable pour les passionnes de jeux numeriques ! Ajoutons que le site est concu avec style et modernite, renforce l’immersion totale.
7bitcasino bewertung|
criskis7zef
1 Nov 25 at 9:29 pm
cheap medicines online UK: UK online pharmacies list – Uk Meds Guide
Johnnyfuede
1 Nov 25 at 9:53 pm
https://t.me/s/UD_BOoI
MichaelPione
1 Nov 25 at 9:54 pm
https://t.me/s/Official_mellstroy_casino
MichaelPione
1 Nov 25 at 9:58 pm
online pharmacy reviews and ratings: best pharmacy sites with discounts – cheapest pharmacies in the USA
HaroldSHems
1 Nov 25 at 10:20 pm
https://t.me/s/UD_KOmEtA
MichaelPione
1 Nov 25 at 10:56 pm
https://t.me/s/Ud_FlagMAN
MichaelPione
1 Nov 25 at 10:58 pm
Ich habe einen totalen Hang zu SpinBetter Casino, es erzeugt eine Spielenergie, die fesselt. Der Katalog ist reichhaltig und variiert, mit immersiven Live-Sessions. Der Service ist von hoher Qualitat, garantiert top Hilfe. Die Gewinne kommen prompt, dennoch regelma?igere Aktionen waren toll. Zusammengefasst, SpinBetter Casino ist ein Muss fur alle Gamer fur Krypto-Enthusiasten ! Daruber hinaus die Navigation ist kinderleicht, verstarkt die Immersion. Zusatzlich zu beachten die Vielfalt an Zahlungsmethoden, die Flexibilitat bieten.
spinbettercasino.de|
ChillgerN4zef
1 Nov 25 at 10:59 pm
https://t.me/s/uD_1XBET
MichaelPione
1 Nov 25 at 11:02 pm
verified pharmacy coupon sites Australia: pharmacy online – verified online chemists in Australia
Johnnyfuede
1 Nov 25 at 11:11 pm
Je suis bluffe par Ruby Slots Casino, ca donne une vibe electrisante. Les options de jeu sont infinies, offrant des sessions live palpitantes. Avec des depots instantanes. Disponible a toute heure via chat ou email. Les transactions sont toujours securisees, malgre tout des offres plus genereuses rendraient l’experience meilleure. En resume, Ruby Slots Casino merite un detour palpitant. Ajoutons que le site est fluide et attractif, facilite une experience immersive. A signaler les tournois frequents pour l’adrenaline, renforce le lien communautaire.
AccГ©der Г la page|
cybercodeon9zef
1 Nov 25 at 11:21 pm
https://t.me/s/UD_jEt
MichaelPione
1 Nov 25 at 11:33 pm
Je suis accro a Sugar Casino, ca transporte dans un monde d’excitation. Le choix est aussi large qu’un festival, offrant des sessions live palpitantes. Il offre un coup de pouce allechant. Les agents sont rapides et pros. Les retraits sont lisses comme jamais, malgre tout quelques free spins en plus seraient bienvenus. Pour conclure, Sugar Casino assure un divertissement non-stop. De surcroit la navigation est fluide et facile, permet une plongee totale dans le jeu. Un avantage les tournois reguliers pour s’amuser, offre des bonus exclusifs.
Savoir plus|
wilddripin6zef
1 Nov 25 at 11:38 pm
Je suis totalement conquis par Sugar Casino, ca offre une experience immersive. La gamme est variee et attrayante, incluant des paris sportifs pleins de vie. Il donne un avantage immediat. Les agents repondent avec efficacite. Les paiements sont securises et rapides, neanmoins des offres plus genereuses seraient top. En somme, Sugar Casino merite un detour palpitant. De surcroit la plateforme est visuellement vibrante, ce qui rend chaque session plus excitante. Egalement genial le programme VIP avec des privileges speciaux, propose des avantages uniques.
DГ©couvrir les faits|
stormsparkus2zef
1 Nov 25 at 11:39 pm