Input validation with filter functions
Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.
Which are available?
Below a shameless copy paste of the PHP documentation.
- filter_has_var — Checks if variable of specified type exists
- filter_id — Returns the filter ID belonging to a named filter
- filter_input_array — Gets external variables and optionally filters them
- filter_input — Gets a specific external variable by name and optionally filters it
- filter_list — Returns a list of all supported filters
- filter_var_array — Gets multiple variables and optionally filters them
- filter_var — Filters a variable with a specified filter
Pratical use
Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.
Sanitizing a single variable
$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");
Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array
filter_var_array($_POST, FILTER_SANITIZE_STRING);
Validating an email address
if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
$this->addError('Invalid email address', $sEmail);
}
Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.
$aData = array(
'student' => 'Sjoerd Maessen',
'class' => '21',
'grades' => array(
'math' => 9,
'geography' => 66,
'gymnastics' => 7.5
)
);
$aValidation = array(
'student' => FILTER_SANITIZE_STRING,
'class' => FILTER_VALIDATE_INT,
'grades' => array(
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_FORCE_ARRAY,
'options'=> array('min_range'=>0, 'max_range'=>10))
);
echo '';
var_dump(filter_var_array($aData, $aValidation));
/*array(3) {
["student"]=>
string(14) "Sjoerd Maessen"
["class"]=>
int(21) // Thats strange, my string is converted
["grades"]=>
array(3) {
["math"]=>
int(9)
["geography"]=>
bool(false) // 66 is > 10
["gymnastics"]=>
bool(false) // 7.5 is not an int
}
}*/
Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider
Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links
Filter functions
Filter flags
https://t.me/s/official_1win_aviator/53
DealerShadow
2 Nov 25 at 2:26 am
https://t.me/s/uD_fRESH
MichaelPione
2 Nov 25 at 3:10 am
https://ukmedsguide.shop/# cheap medicines online UK
Haroldovaph
2 Nov 25 at 3:16 am
best Australian pharmacies [url=http://aussiemedshubau.com/#]Aussie Meds Hub[/url] verified pharmacy coupon sites Australia
Hermanengam
2 Nov 25 at 3:26 am
Irish Pharma Finder: irishpharmafinder – buy medicine online legally Ireland
Johnnyfuede
2 Nov 25 at 3:41 am
https://t.me/s/ud_voDkA
MichaelPione
2 Nov 25 at 3:47 am
https://t.me/official_1win_aviator/43
DealerShadow
2 Nov 25 at 3:50 am
compare pharmacy websites: compare pharmacy websites – pharmacy online
HaroldSHems
2 Nov 25 at 3:54 am
https://t.me/s/official_1win_aviator/82
BluffMaster
2 Nov 25 at 3:55 am
https://t.me/official_1win_aviator/79
DealerShadow
2 Nov 25 at 4:05 am
https://t.me/s/Ud_rIoBet
MichaelPione
2 Nov 25 at 4:15 am
https://t.me/s/Ud_GAMa
MichaelPione
2 Nov 25 at 4:16 am
https://t.me/s/UD_VULKAN
MichaelPione
2 Nov 25 at 4:21 am
online pharmacy: discount pharmacies in Ireland – Irish online pharmacy reviews
Johnnyfuede
2 Nov 25 at 5:02 am
https://t.me/s/Ud_pIn_up
MichaelPione
2 Nov 25 at 5:25 am
J’adore la vibe de Ruby Slots Casino, ca invite a plonger dans le fun. La gamme est variee et attrayante, offrant des sessions live palpitantes. Il booste votre aventure des le depart. Les agents repondent avec rapidite. Les gains arrivent en un eclair, quelquefois des bonus varies rendraient le tout plus fun. Globalement, Ruby Slots Casino est un endroit qui electrise. Par ailleurs l’interface est lisse et agreable, ajoute une touche de dynamisme. A souligner les evenements communautaires engageants, qui stimule l’engagement.
Plonger dedans|
cybercodeon9zef
2 Nov 25 at 5:25 am
https://t.me/s/official_1win_aviator/53
LuckyBandit
2 Nov 25 at 5:31 am
discount pharmacies in Ireland
Edmundexpon
2 Nov 25 at 5:44 am
https://t.me/s/Ud_monRo
MichaelPione
2 Nov 25 at 6:35 am
https://t.me/s/Ud_GiZbo
MichaelPione
2 Nov 25 at 7:06 am
buy medicine online legally Ireland
Edmundexpon
2 Nov 25 at 7:14 am
cheap medicines online UK [url=http://ukmedsguide.com/#]non-prescription medicines UK[/url] UkMedsGuide
Hermanengam
2 Nov 25 at 7:26 am
Irish online pharmacy reviews: Irish online pharmacy reviews – best Irish pharmacy websites
HaroldSHems
2 Nov 25 at 7:58 am
https://t.me/s/Ud_KEnT
MichaelPione
2 Nov 25 at 8:43 am
проститутки ебло Проститутка метро: Тени подземки, где стыд прячется в толпе. Краткий миг встречи, растворяющийся в гуле вагонов. Холод кафеля и тепло чужого тела.
JohnnyFrula
2 Nov 25 at 8:58 am
promo codes for online drugstores [url=https://safemedsguide.com/#]trusted online pharmacy USA[/url] cheapest pharmacies in the USA
Hermanengam
2 Nov 25 at 9:27 am
Ich liebe die Atmosphare bei Cat Spins Casino, es bietet ein mitrei?endes Spielerlebnis. Die Spiele sind abwechslungsreich und spannend, mit Spielen, die Krypto unterstutzen. Er bietet einen tollen Startvorteil. Der Service ist von hochster Qualitat. Transaktionen laufen reibungslos, dennoch mehr Bonusangebote waren spitze. Abschlie?end, Cat Spins Casino ist ein Top-Ziel fur Casino-Fans. Zudem ist das Design zeitgema? und attraktiv, was jede Session spannender macht. Ein gro?artiges Bonus die vielfaltigen Wettmoglichkeiten, sichere Zahlungen garantieren.
Weitergehen|
nightfireus1zef
2 Nov 25 at 9:28 am
Hi this is kind of of off topic but I was wondering if blogs use WYSIWYG editors or if you have to manually code with HTML. I’m starting a blog soon but have no coding experience so I wanted to get guidance from someone with experience. Any help would be enormously appreciated!
https://www.digitalthinkhub.com/mobilemelbet-obzor-bk-melbet-2025/
LhaneDrync
2 Nov 25 at 9:30 am
irishpharmafinder: buy medicine online legally Ireland – affordable medication Ireland
HaroldSHems
2 Nov 25 at 9:31 am
discount pharmacies in Ireland: irishpharmafinder – online pharmacy
Johnnyfuede
2 Nov 25 at 9:36 am
https://t.me/s/UD_drIp
MichaelPione
2 Nov 25 at 9:47 am
best online pharmacy: buy medications online safely – best pharmacy sites with discounts
Johnnyfuede
2 Nov 25 at 10:58 am
https://t.me/s/tf_1win
CaseyAccuh
2 Nov 25 at 11:20 am
Irish online pharmacy reviews
Edmundexpon
2 Nov 25 at 11:36 am
http://aussiemedshubau.com/# Aussie Meds Hub Australia
Haroldovaph
2 Nov 25 at 12:39 pm
https://t.me/s/tf_1win
TracyFat
2 Nov 25 at 12:51 pm
discount pharmacies in Ireland
Edmundexpon
2 Nov 25 at 1:04 pm
https://t.me/s/kfo_1win
TracyFat
2 Nov 25 at 1:19 pm
Irish online pharmacy reviews [url=http://irishpharmafinder.com/#]best Irish pharmacy websites[/url] Irish Pharma Finder
Hermanengam
2 Nov 25 at 1:24 pm
trusted online pharmacy Australia: Australian pharmacy reviews – verified pharmacy coupon sites Australia
HaroldSHems
2 Nov 25 at 1:26 pm
https://t.me/s/Top_bk_ru
StevenHig
2 Nov 25 at 1:41 pm
https://t.me/s/tf_1win
StevenHig
2 Nov 25 at 1:47 pm
https://t.me/s/kfo_1win
StevenHig
2 Nov 25 at 2:16 pm
https://t.me/s/kta_1win
StevenHig
2 Nov 25 at 2:49 pm
online pharmacy ireland: affordable medication Ireland – best Irish pharmacy websites
HaroldSHems
2 Nov 25 at 2:58 pm
best UK pharmacy websites [url=https://ukmedsguide.com/#]Uk Meds Guide[/url] UkMedsGuide
Hermanengam
2 Nov 25 at 3:23 pm
pharmacy discount codes AU: cheap medicines online Australia – trusted online pharmacy Australia
Johnnyfuede
2 Nov 25 at 3:26 pm
http://safemedsguide.com/# top rated online pharmacies
Haroldovaph
2 Nov 25 at 4:10 pm
Je suis fascine par Wild Robin Casino, ca transporte dans un monde d’excitation. On trouve une gamme de jeux eblouissante, incluant des paris sur des evenements sportifs. Il amplifie le plaisir des l’entree. Le support client est irreprochable. Les gains arrivent en un eclair, toutefois des offres plus consequentes seraient parfaites. Pour conclure, Wild Robin Casino est un choix parfait pour les joueurs. A signaler le design est moderne et attrayant, apporte une energie supplementaire. Un atout les options de paris sportifs diversifiees, cree une communaute vibrante.
VГ©rifier le site|
SolarBeatar8zef
2 Nov 25 at 4:17 pm
Je suis enthousiaste a propos de Wild Robin Casino, on ressent une ambiance festive. La bibliotheque est pleine de surprises, comprenant des titres adaptes aux cryptomonnaies. Avec des depots instantanes. Disponible a toute heure via chat ou email. Les paiements sont securises et instantanes, cependant des recompenses supplementaires dynamiseraient le tout. Globalement, Wild Robin Casino offre une experience hors du commun. Notons egalement le design est moderne et attrayant, ce qui rend chaque moment plus vibrant. Egalement top le programme VIP avec des privileges speciaux, garantit des paiements securises.
Commencer Г dГ©couvrir|
Quantumeagleex5zef
2 Nov 25 at 4:19 pm