PHP Filters

PHP Filters: Validating and Cleaning External Data

PHP's Filter extension provides tested, built-in rules for validating untrusted input from forms, query parameters, and API payloads. Using filter_var() and filter_input() replaces error-prone manual checks with clear, standardized flags.

Common Validation Filters with filter_var()

Every validation filter returns either the validated value on success or false on failure. Always compare strictly against false so valid falsy values like 0 or false do not trip your error checks.

<?php
declare(strict_types=1);

$rawPage = "3";
$rawEmail = "[email protected]";
$rawIp = "192.168.1.25";

$page = filter_var($rawPage, FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 1, 'max_range' => 500],
]);
$email = filter_var($rawEmail, FILTER_VALIDATE_EMAIL);
$ip = filter_var($rawIp, FILTER_VALIDATE_IP);

var_dump($page, $email, $ip);

Reading Request Superglobals with filter_input()

filter_input(INPUT_GET, 'page', FILTER_VALIDATE_INT) reads directly from the original HTTP input instead of a potentially modified $_GET array, returning null if the parameter is missing and false if invalid.

Common Mistakes to Avoid

• Checking if (!$intVal) after FILTER_VALIDATE_INT: If the user enters "0", filter_var("0", FILTER_VALIDATE_INT) returns 0, which evaluates as falsy in if (!$intVal). Always write if ($intVal === false).
• Using deprecated FILTER_SANITIZE_STRING: Removed in PHP 8.2+ because stripping tags breaks legitimate text like 5 < 10. Escape on output with htmlspecialchars() instead.
• Forgetting FILTER_NULL_ON_FAILURE for booleans: By default, FILTER_VALIDATE_BOOLEAN returns false both for "false" and invalid strings like "banana". Add FILTER_NULL_ON_FAILURE to detect invalid inputs.

Frequently Asked Questions

When should I use filter_var() instead of is_int()?

HTTP query parameters and form inputs always arrive as strings ("42"). is_int("42") returns false, whereas filter_var("42", FILTER_VALIDATE_INT) returns 42.

How does FILTER_FLAG_ALLOW_OCTAL or FILTER_FLAG_IPV6 work?

Flags customize a filter's rules—for example, FILTER_FLAG_NO_PRIV_RANGE rejects local network IPs like 192.168.1.1 when validating public server endpoints.

Can filter_var_array() validate multiple fields at once?

Yes. Pass an associative input array and a rule map to filter_var_array() to validate an entire request payload in one call.