PHP Filters

PHP Filter Extension (filter_var(), Sanitization & Validation)

The PHP Filter Extension provides robust built-in capabilities to validate and sanitize user inputs, forms, and variables without writing custom regex patterns.

Validation vs Sanitization Filters

• Validation Filters: Test whether input meets structural format requirements (Returns value on success, false on failure).
• Sanitization Filters: Remove illegal or unsafe characters from input string (Returns cleaned string).

flowchart LR
    A["Raw Input Variable"] --> B{"Choose Filter Category"}
    B -- Validation (FILTER_VALIDATE_*) --> C["FILTER_VALIDATE_INT
FILTER_VALIDATE_EMAIL
FILTER_VALIDATE_IP
FILTER_VALIDATE_BOOLEAN"]
    B -- Sanitization (FILTER_SANITIZE_*) --> D["FILTER_SANITIZE_EMAIL
FILTER_SANITIZE_NUMBER_INT
FILTER_SANITIZE_SPECIAL_CHARS"]

Practical Code Example

<?php
declare(strict_types=1);

// 1. Validating Integer with Range Options
$userAge = "25";
$validAge = filter_var($userAge, FILTER_VALIDATE_INT, [
    "options" => ["min_range" => 18, "max_range" => 65]
]);

// 2. Validating IP Address (IPv4 / IPv6)
$ipAddress = "192.168.1.100";
$validIP = filter_var($ipAddress, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4);

// 3. Sanitizing Integers from Dirty Input Strings
$dirtyString = "Price is $450 USD";
$cleanNumber = filter_var($dirtyString, FILTER_SANITIZE_NUMBER_INT); // "450"

// 4. Validating Boolean Input ('true', '1', 'on', 'yes')
$checkboxInput = "on";
$isAccepted = filter_var($checkboxInput, FILTER_VALIDATE_BOOLEAN);

echo "Valid Age: " . ($validAge !== false ? $validAge : "Invalid") . "
";
echo "Valid IPv4?: " . ($validIP !== false ? "Yes ($validIP)" : "No") . "
";
echo "Extracted Number: " . $cleanNumber . "
";
echo "Checkbox State: " . ($isAccepted ? "Enabled" : "Disabled") . "
";

Best Practices

• Use filter_input() for Superglobals: Use filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL) directly rather than accessing $_POST['email'].
• Use FILTER_VALIDATE_BOOLEAN for Checkboxes: Handles '1', 'true', 'on', and 'yes' correctly.
• Use Explicit Options Arrays: Pass range bounds (min_range, max_range) to filter integer values in a single call.

Self-Check Challenge

Write a filter_var() check that validates an IP address string $ip using FILTER_VALIDATE_IP!