PHP Filters

PHP filters are used to validate and filter data coming from insecure sources, such as user input. No additional installation is required to use these filters, as they are enabled by default. When using advanced filters, we can apply various options to customize the filters for validating and sanitizing input data. Here we will look at some of the more advanced ways to use filters.

EXAMPLE

[file:filter_var()]
<?php
$ip = "127.0.0.1";

// Using FILTER_VALIDATE_IP with advanced options
$options = [
    'flags' => FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
];

$filtered_ip = filter_var($ip, FILTER_VALIDATE_IP, $options);

if ($filtered_ip !== false) {
    echo "IP address is valid: " . $filtered_ip;
} else {
    echo "IP address is not valid.";
}
?>

[file:filter_var_array()]
<?php
// Input array simulating e.g. $_POST data
$data = [
 'username' => 'uglyDuckling',
 'age' => '51',
 'email' => 'john.doe@demo.com'
];

// Definition of filters for individual variables
$filters = [
    'username' => [
        'filter' => FILTER_CALLBACK,
        'options' => function ($value) {
            // Support for special characters and length of 3-20 characters
            return preg_match('/^[a-zA-Z0-9čšžČŠŽ]{3,20}$/u', $value) ? $value : false;
        }
    ],
    'age' => [
        'filter' => FILTER_VALIDATE_INT,
        'options' => [
            'min_range' => 1,
            'max_range' => 120
        ]
    ],
    'email' => FILTER_VALIDATE_EMAIL
];

// Using filter_var_array to filter input data
$filtered_data = filter_var_array($data, $filters);

if ($filtered_data) {
 if ($filtered_data['username'] === false) {
 echo "Username is not valid.";
 } else {
 echo "Username: " . htmlspecialchars($filtered_data['username']) . " ";
 }

if ($filtered_data['age'] === false) {
 echo "Age is not valid.";
 } else {
 echo "Age: " . htmlspecialchars($filtered_data['age']) . " ";
 }

if ($filtered_data['email'] === false) {
        echo "Email address is not valid.";
    } else {
        echo "Email: " . htmlspecialchars($filtered_data['email']);
    }
}
?>

[file:filter_var_array_x()]
<?php
// Third example: Why does "uglyDuckling" not pass through the filter?
$data = [
 'username' => 'uglyDuckling',
 'age' => '52',
 'email' => 'jane.smith@demo.com'
];

// Filter definition with a CALLBACK function and strict regex
$filters = [
    'username' => [
        'filter' => FILTER_CALLBACK,
        'options' => function ($value) {
            // This regex only allows a-z, A-Z and 0-9. Special characters (čšž) will be rejected!
            return preg_match('/^[a-zA-Z0-9]{3,20}$/', $value) ? $value : false;
        }
    ],
    'age' => [
        'filter' => FILTER_VALIDATE_INT,
        'options' => ['min_range' => 1, 'max_range' => 120]
    ],
    'email' => FILTER_VALIDATE_EMAIL
];

$filtered_data = filter_var_array($data, $filters);

if ($filtered_data) {
 if ($filtered_data['username'] === false) {
 echo "Username is not valid (contains disallowed characters). ";
 } else {
 echo "Username: " . htmlspecialchars($filtered_data['username']) . " ";
 }

if ($filtered_data['age'] === false) {
 echo "Age is not valid.";
 } else {
 echo "Age: " . htmlspecialchars($filtered_data['age']) . " ";
 }

if ($filtered_data['email'] === false) {
 echo "Email address is not valid.";
 } else {
 echo "Email: " . htmlspecialchars($filtered_data['email']) . " ";
 }
}
?>

RESULT

The result will be displayed here...

The behavior of these filters is affected by settings in the php.ini file:

name	description	default	changeable
filter.default	This filter filters all $_GET, $_POST, $_COOKIE, $_REQUEST, and $_SERVER data. It accepts the name of the filter you want to use by default. See the filter list for the list of filter names.	unsafe_raw	PHP_INI_PERDIR
filter.default_flags	Default flags to apply when the default filter is set. It is set to `FILTER_FLAG_NO_ENCODE_QUOTES` by default for backwards compatibility.	NULL	PHP_INI_PERDIR

Overview of PHP Filtering Functions

PHP offers a set of built-in functions that allow you to check for the existence of input data and filter it directly:

Function Name	Description	Example (Code for simulator)
`filter_has_var()`	Checks if a variable of a specific type (POST/GET) exists.	`echo filter_has_var(INPUT_POST, 'email') ? 'Exists' : 'Does not exist';`
`filter_id()`	Returns the internal ID number of a specified filter name.	`echo "Email filter ID is: " . filter_id("validate_email");`
`filter_input()`	Gets an external variable and filters it immediately.	`echo "URL: " . filter_input(INPUT_POST, 'web', FILTER_VALIDATE_URL);`
`filter_input_array()`	Gets multiple external variables at once and filters them.	`$f = ['input' => FILTER_VALIDATE_INT]; print_r(filter_input_array(INPUT_POST, $f));`
`filter_list()`	Returns an indexed array of all supported filter names.	`print_r(filter_list());`
`filter_var()`	Filters a specific variable with a specified filter.	`echo filter_var('test@email.com', FILTER_VALIDATE_EMAIL) ? 'Valid' : 'Invalid';`
`filter_var_array()`	Filters multiple variables at once using an array of filters.	`$p = ['a' => 10]; $f = ['a' => FILTER_VALIDATE_INT]; print_r(filter_var_array($p, $f));`

How Filters Work

We define specific rules for each filter using options and flags.
For more complex validations, we can use FILTER_CALLBACK and pass a custom function in the options.
The ability to define specific rules and filters for each variable allows for a high degree of flexibility.

FILTER_VALIDATE_IP with various flags:

FILTER_FLAG_IPV4
FILTER_FLAG_IPV6
FILTER_FLAG_NO_PRIV_RANGE
FILTER_FLAG_NO_RES_RANGE

FILTER_VALIDATE_URL with flags:

FILTER_FLAG_PATH_REQUIRED
FILTER_FLAG_QUERY_REQUIRED

Using these methods, we can control the validation and sanitization of input data very precisely, which improves the security of our application.

PHP Filters

Overview of PHP Filtering Functions

How Filters Work

Advanced Filter Options