Input validation with filter functions
Introduction
Although PHP has a lot of filter functions available, I found that still to many people are using (often incorrect) regular expressions to validate user input. The filter extension is simple, standard available and will fulfill the common validations. Below some pratical examples and things to consider when working with PHP filter functions.
Which are available?
Below a shameless copy paste of the PHP documentation.
- filter_has_var — Checks if variable of specified type exists
- filter_id — Returns the filter ID belonging to a named filter
- filter_input_array — Gets external variables and optionally filters them
- filter_input — Gets a specific external variable by name and optionally filters it
- filter_list — Returns a list of all supported filters
- filter_var_array — Gets multiple variables and optionally filters them
- filter_var — Filters a variable with a specified filter
Pratical use
Sanitizing
“Filter input escape output” every developer knows this but it is a repetitive job but with the filter extension filterering input became a lot easier. When you correctly filter input you drastically lower the change of application vulnerabilities.
Sanitizing a single variable
$sText = ' ';
$sText = filter_var($sText, FILTER_SANITIZE_STRING);
echo $sText; // This is a comment from a alert("scriptkiddie");
Sanitizing multiple variables, same principle as above but with an array, the filter will sanitize all values inside the array
filter_var_array($_POST, FILTER_SANITIZE_STRING);
Validating an email address
if(filter_var($sEmail, FILTER_VALIDATE_EMAIL) === false) {
$this->addError('Invalid email address', $sEmail);
}
Validation a complete array
Validating all your data at once with a single filter will make your code clear, all in one place and is more easy to maintain an example below.
$aData = array(
'student' => 'Sjoerd Maessen',
'class' => '21',
'grades' => array(
'math' => 9,
'geography' => 66,
'gymnastics' => 7.5
)
);
$aValidation = array(
'student' => FILTER_SANITIZE_STRING,
'class' => FILTER_VALIDATE_INT,
'grades' => array(
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_FORCE_ARRAY,
'options'=> array('min_range'=>0, 'max_range'=>10))
);
echo '';
var_dump(filter_var_array($aData, $aValidation));
/*array(3) {
["student"]=>
string(14) "Sjoerd Maessen"
["class"]=>
int(21) // Thats strange, my string is converted
["grades"]=>
array(3) {
["math"]=>
int(9)
["geography"]=>
bool(false) // 66 is > 10
["gymnastics"]=>
bool(false) // 7.5 is not an int
}
}*/
Note: okay I did not expect that the string '21' would validate true against FILTER_VALIDATE_INT, after some more testing I also noticed that min_range and max_range only work with FILTER_VALIDATE_INT, when using floats or scalars the options are just ignored, so be aware!
The sanitizing examples above can be made easily more restrictive by adding flags like FILTER_FLAG_STRIP_LOW to the sanitize filter, FILTER_FLAG_STRIP_LOW will for example strip all characters that have a numerical value below 32.
Things to consider
Although the filter functions are some time available some of them aren't flawless, at some points the documentation is missing or very unclear. Another example is the filter_var validation for IPv6 addresses. (see bug report #50117). So it is always a good thing to check if the filter is really doing what you expect it does. Write testcases before using. If you use it correctly you can write your validations in the blink of an eye, and this extension will be your new best friend.
Links
Filter functions
Filter flags
prescription-free muscle relaxants: Tizanidine tablets shipped to USA – order Tizanidine without prescription
Antonionek
4 Aug 25 at 1:14 am
http://ivercarepharmacy.com/# IverCare Pharmacy
Jefferyled
4 Aug 25 at 1:52 am
AsthmaFree Pharmacy: AsthmaFree Pharmacy – AsthmaFree Pharmacy
Raymondheaps
4 Aug 25 at 2:15 am
ventolin 4mg [url=http://asthmafreepharmacy.com/#]AsthmaFree Pharmacy[/url] ventolin online nz
Harryinapy
4 Aug 25 at 5:35 am
FluidCare Pharmacy: FluidCare Pharmacy – lasix 20 mg
Antonionek
4 Aug 25 at 7:41 am
lasix generic name: lasix furosemide – lasix uses
Raymondheaps
4 Aug 25 at 8:16 am
rybelsus tijuana [url=https://glucosmartrx.shop/#]AsthmaFree Pharmacy[/url] AsthmaFree Pharmacy
Harryinapy
4 Aug 25 at 12:34 pm
ivermectin 12 mg: IverCare Pharmacy – IverCare Pharmacy
Jessieopins
4 Aug 25 at 2:30 pm
ivermectin for lyme: how much does ivermectin cost – IverCare Pharmacy
Raymondheaps
4 Aug 25 at 3:24 pm
http://ivercarepharmacy.com/# ivermectin resistance
Jefferyled
4 Aug 25 at 5:18 pm
affordable Zanaflex online pharmacy [url=http://relaxmedsusa.com/#]muscle relaxants online no Rx[/url] RelaxMeds USA
Harryinapy
4 Aug 25 at 7:07 pm
AsthmaFree Pharmacy: AsthmaFree Pharmacy – semaglutide alternatives
Raymondheaps
4 Aug 25 at 9:01 pm
AsthmaFree Pharmacy [url=https://glucosmartrx.com/#]is tirzepatide a semaglutide[/url] foods to avoid on semaglutide
Harryinapy
5 Aug 25 at 1:42 am
buy furosemide online: FluidCare Pharmacy – lasix furosemide 40 mg
Raymondheaps
5 Aug 25 at 4:10 am
lasix generic name: lasix 20 mg – lasix
Jessieopins
5 Aug 25 at 5:05 am
https://asthmafreepharmacy.shop/# ventolin discount coupon
Jefferyled
5 Aug 25 at 10:26 am
lasix 100 mg [url=https://fluidcarepharmacy.com/#]lasix 40 mg[/url] FluidCare Pharmacy
Harryinapy
5 Aug 25 at 10:40 am
relief from muscle spasms online: relief from muscle spasms online – cheap muscle relaxer online USA
Raymondheaps
5 Aug 25 at 12:31 pm
buy ventolin online: ventolin without a prescription – where can i order ventolin in canada without a prescription
Jessieopins
5 Aug 25 at 3:58 pm
ventolin 10 mg [url=https://asthmafreepharmacy.com/#]AsthmaFree Pharmacy[/url] AsthmaFree Pharmacy
Harryinapy
5 Aug 25 at 6:14 pm
AsthmaFree Pharmacy: AsthmaFree Pharmacy – AsthmaFree Pharmacy
Raymondheaps
5 Aug 25 at 7:44 pm
FluidCare Pharmacy [url=https://fluidcarepharmacy.com/#]FluidCare Pharmacy[/url] buy lasix online
Harryinapy
6 Aug 25 at 1:58 am
AsthmaFree Pharmacy: AsthmaFree Pharmacy – what are the doses of semaglutide
Raymondheaps
6 Aug 25 at 3:23 am
https://glucosmartrx.com/# rybelsus gastroparesis
Jefferyled
6 Aug 25 at 3:37 am
AsthmaFree Pharmacy [url=https://asthmafreepharmacy.shop/#]ventolin inhaler no prescription[/url] no prescription ventolin hfa
Harryinapy
6 Aug 25 at 8:30 am
lasix online: lasix furosemide 40 mg – furosemide 100 mg
Robertpak
6 Aug 25 at 9:24 am
AsthmaFree Pharmacy: AsthmaFree Pharmacy – AsthmaFree Pharmacy
Raymondheaps
6 Aug 25 at 9:26 am
I used to be able to find good advice from your content.
Dove acquistare farmaci al miglior prezzo
EarnestAbent
6 Aug 25 at 11:53 am
generic lasix [url=http://fluidcarepharmacy.com/#]lasix 100 mg[/url] FluidCare Pharmacy
Harryinapy
6 Aug 25 at 4:36 pm
FluidCare Pharmacy: lasix online – lasix 40mg
Raymondheaps
6 Aug 25 at 4:58 pm
ivermectin scabies treatment: IverCare Pharmacy – IverCare Pharmacy
Robertpak
6 Aug 25 at 5:48 pm
prescription-free muscle relaxants [url=http://relaxmedsusa.com/#]trusted pharmacy Zanaflex USA[/url] prescription-free muscle relaxants
Harryinapy
6 Aug 25 at 5:55 pm
https://fluidcarepharmacy.shop/# lasix dosage
Jefferyled
6 Aug 25 at 8:27 pm
Tizanidine 2mg 4mg tablets for sale: Tizanidine tablets shipped to USA – order Tizanidine without prescription
Raymondheaps
6 Aug 25 at 8:28 pm
RelaxMedsUSA [url=https://relaxmedsusa.com/#]Zanaflex medication fast delivery[/url] order Tizanidine without prescription
Harryinapy
6 Aug 25 at 11:52 pm
affordable Zanaflex online pharmacy: Tizanidine 2mg 4mg tablets for sale – buy Zanaflex online USA
Raymondheaps
7 Aug 25 at 12:00 am
safe online source for Tizanidine: trusted pharmacy Zanaflex USA – Tizanidine tablets shipped to USA
Robertpak
7 Aug 25 at 12:45 am
IverCare Pharmacy: can humans take animal ivermectin – IverCare Pharmacy
Jessieopins
7 Aug 25 at 3:48 am
AsthmaFree Pharmacy: AsthmaFree Pharmacy – AsthmaFree Pharmacy
Raymondheaps
7 Aug 25 at 6:42 am
IverCare Pharmacy [url=https://ivercarepharmacy.com/#]IverCare Pharmacy[/url] side effects of ivermectin in dogs
Harryinapy
7 Aug 25 at 6:50 am
ivermectin heartworms: stromectol amazon – ivermectin lawsuit
Jessieopins
7 Aug 25 at 11:04 am
http://glucosmartrx.com/# how to reconstitute 5mg semaglutide
Jefferyled
7 Aug 25 at 1:04 pm
lasix 100 mg: lasix tablet – FluidCare Pharmacy
Raymondheaps
7 Aug 25 at 1:15 pm
FluidCare Pharmacy [url=http://fluidcarepharmacy.com/#]lasix tablet[/url] furosemida 40 mg
Harryinapy
7 Aug 25 at 1:33 pm
IverCare Pharmacy: ivermectin for cattle tractor supply – buying ivermectin online
Jessieopins
7 Aug 25 at 5:37 pm