PHP Filters
The PHP Filter Extension
PHP filters are used to validate and sanitize insecure external input (like user-inputs from forms, cookies, web services, or database queries).
Validating data = Checks if the data is in proper form (e.g. valid email format, URL, integer, etc).
Sanitizing data = Removes any illegal character from the data.
Always validate external data!
Insecure submitted data can lead to security problems and break your webpage!
By using PHP filters you can be sure your application gets the correct input!
PHP Filter Functions
The PHP filter extension has many functions for checking user input, and is designed to make data validation easier and quicker:
filter_var()- Filters a single variable with a specified filterfilter_input()- Gets an external variable (e.g. from form input) and filters itfilter_var_array()- Filters multiple external variables (an array) and filters themfilter_list()- Lists all supported filter names and ids
PHP filter_list() Function
The filter_list() function
is used to list all supported filter names and their ids.
The following example lists the supported filter names and their ids in an HTML table:
Example
<table>
<tr>
<th>Filter Name</th>
<th>Filter ID</th>
</tr>
<?php
foreach (filter_list() as $id =>$filter) {
echo '<tr><td>' . $filter . '</td><td>' . filter_id($filter) . '</td></tr>';
}
?>
</table>
Try it Yourself »
PHP filter_var() Function
The filter_var() function filters a single variable with a specified filter.
Syntax
filter_var(var, filter, options);Parameters:
- var - Required. Specifies the variable to filter
- filter - Optional. Specifies the id or name of the filter to use
- options - Optional. Specifies one or more flags/option to use
PHP Types of Filters
In PHP, there are two types of filters:
Validation filters: These filters will check if the data meets specific criteria, but do not change the data itself. It will return false if data is invalid.
Examples of validation filters:
- FILTER_VALIDATE_EMAIL
- FILTER_VALIDATE_URL
- FILTER_VALIDATE_INT
- FILTER_VALIDATE_IP
Sanitization filters: These filters will remove illegal characters from the data, and may alter the input.
Examples of sanitization filters:
- FILTER_SANITIZE_EMAIL (removes illegal email characters)
- FILTER_SANITIZE_URL (removes illegal URL characters)
- FILTER_SANITIZE_NUMBER_INT (removes all characters except digits and + - signs)
For a complete reference of all filters, go to our PHP Filter Reference.
Sanitize and Validate an Email
The following example uses the
filter_var() function to first remove all
illegal characters from the $email variable, then check if it
is a valid email address:
Example
<?php
$email = "john.doe@example.com";
// Remove illegal characters from email
$email = filter_var($email, FILTER_SANITIZE_EMAIL);
// Validate email
if (!filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
echo("$email is a valid email address");
} else {
echo("$email is not a valid email address");
}
?>
Try it Yourself »
Sanitize and Validate a URL
The following example uses the
filter_var() function to first remove all
illegal characters from a URL, then check if $url is a valid URL:
Example
<?php
$url = "https://www.w3schools.com";
// Remove illegal characters from url
$url = filter_var($url, FILTER_SANITIZE_URL);
// Validate url
if (!filter_var($url, FILTER_VALIDATE_URL) === false) {
echo("$url is a valid URL");
} else {
echo("$url is not a valid URL");
}
?>
Try it Yourself »
Validate an Integer
The following example uses the
filter_var() function to check if the variable $int
is an integer. If $int is an integer,
the output of the code below will be: "Integer is valid". If $int is not an integer,
the output will be: "Integer is not valid":
Example
<?php
$int = 100;
if (!filter_var($int, FILTER_VALIDATE_INT) === false) {
echo("Integer is valid");
} else {
echo("Integer is not valid");
}
?>
Try it Yourself »
Tip: filter_var() and Problem With 0
In the example above, if $int was set to 0, the function above will return "Integer is not valid". To solve this problem, use the code below:
Example
<?php
$int = 0;
if (filter_var($int, FILTER_VALIDATE_INT) === 0 || !filter_var($int, FILTER_VALIDATE_INT) === false) {
echo("Integer is valid");
} else {
echo("Integer is not valid");
}
?>
Try it Yourself »
Validate an IP Address
The following example uses the
filter_var() function to check if the variable $ip
is a valid IP address:
Example
<?php
$ip = "127.0.0.1";
if (!filter_var($ip, FILTER_VALIDATE_IP) === false) {
echo("$ip is a valid IP address");
} else {
echo("$ip is not a valid IP address");
}
?>
Try it Yourself »
Complete PHP Filter Reference
For a complete reference of all filter functions, go to our PHP Filter Reference. Check each filter to see what options and flags are available.
The reference contains a brief description, and examples of use, for each function!
