PHP Filters Advanced

PHP Advanced Filters: Bounds, Flags, and Batch Array Validation

Advanced PHP filters let you enforce exact numeric boundaries, reject private IP addresses, validate Unicode URLs, and check multi-field payloads in one call. Combining filter options with bitmask flags eliminates dozens of boilerplate if statements.

Enforcing Numeric Ranges and IP Flags

Pass an 'options' array to filter_var() to restrict integers between minimum and maximum bounds, or pass 'flags' to tighten IP and URL rules.

<?php
declare(strict_types=1);

// 1. Validate port number between 1024 and 65535
$port = filter_var('8080', FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 1024, 'max_range' => 65535],
]);

// 2. Accept only public IPv4/IPv6 addresses (block localhost and private LANs)
$clientIp = '192.168.0.10';
$publicIp = filter_var(
    $clientIp,
    FILTER_VALIDATE_IP,
    FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
);

// 3. Parse boolean strictly with null on unrecognized values
$notify = filter_var('maybe', FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE);

var_dump($port, $publicIp, $notify);

Notice how 192.168.0.10 returns false when FILTER_FLAG_NO_PRIV_RANGE is active—handy when fetching user-supplied webhook URLs to help defend against Server-Side Request Forgery (SSRF).

Batch Validation with filter_var_array()

When validating configuration arrays or API query filters, filter_var_array() applies a clean schema map across every key at once.

<?php
declare(strict_types=1);

$query = [
    'page' => '2',
    'per_page' => '250', // Exceeds max_range 100
    'active' => 'true',
];

$rules = [
    'page' => [
        'filter' => FILTER_VALIDATE_INT,
        'options' => ['min_range' => 1, 'default' => 1],
    ],
    'per_page' => [
        'filter' => FILTER_VALIDATE_INT,
        'options' => ['min_range' => 5, 'max_range' => 100, 'default' => 20],
    ],
    'active' => [
        'filter' => FILTER_VALIDATE_BOOLEAN,
        'flags' => FILTER_NULL_ON_FAILURE,
    ],
];

$validated = filter_var_array($query, $rules);
print_r($validated);

Common Mistakes to Avoid

• Expecting 'default' to throw an error: When you set 'default' => 20, out-of-range inputs silently fall back to 20 instead of returning false. Omit 'default' when you want to return a 422 validation error to the user.
• Using FILTER_FLAG_STRIP_HIGH on international text: Stripping bytes above ASCII 127 destroys non-English names and emojis.
• Assuming FILTER_FLAG_NO_PRIV_RANGE alone stops all SSRF: Domain names can still resolve to 127.0.0.1 via DNS. Resolve the hostname with dns_get_record() or gethostbyname() first, then filter the IP.

Frequently Asked Questions

How do I combine multiple filter flags?

Combine flags using the bitwise OR operator |, such as FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE.

What does FILTER_CALLBACK allow?

FILTER_CALLBACK runs a custom callable function on the input value inside filter_var() or filter_var_array(), useful for normalizing slugs or stripping prefixes.

Does filter_var_array() remove extra keys not listed in $rules?

Yes. Keys missing from the definition array are omitted from the returned array, keeping only expected fields.