PHP Filters Advanced

PHP Filters Advanced Usage

Beyond basic validation and sanitization, the PHP filter extension offers flags and options for more specific filtering tasks, as well as mechanisms for filtering multiple inputs at once.

Using Filter Options and Flags

Many filters accept an options parameter in filter_var() (and related functions). This can be an integer holding flags or an associative array specifying options and flags.

Validate an Integer Within a Range

The FILTER_VALIDATE_INT filter accepts min_range and max_range options.

<?php

$input = 122;
$min = 1;
$max = 100; // Note: 122 is outside this range

$options = [
    'options' => [
        'min_range' => $min,
        'max_range' => $max
    ],
    'flags' => FILTER_NULL_ON_FAILURE // Use null on failure for clarity
];

$validatedInt = filter_var($input, FILTER_VALIDATE_INT, $options);

if ($validatedInt !== null) {
    echo "Value {$input} is within the legal range [{$min}, {$max}].<br>";
} else {
    echo "Value {$input} is NOT within the legal range [{$min}, {$max}].<br>";
}

$inputInRange = 50;
$validatedIntInRange = filter_var($inputInRange, FILTER_VALIDATE_INT, $options);

if ($validatedIntInRange !== null) {
    echo "Value {$inputInRange} is within the legal range [{$min}, {$max}].<br>";
} else {
    echo "Value {$inputInRange} is NOT within the legal range [{$min}, {$max}].<br>";
}

?>

Validate IPv6 Address Specifically

Use the FILTER_FLAG_IPV6 flag with FILTER_VALIDATE_IP to require an IPv6 format.

<?php

$ipv6 = "2001:0db8:85a3:08d3:1319:8a2e:0370:7334";
$ipv4 = "192.168.1.1";

if (filter_var($ipv6, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
    echo "'{$ipv6}' is a valid IPv6 address.<br>";
} else {
    echo "'{$ipv6}' is NOT a valid IPv6 address.<br>";
}

// This will fail because FILTER_FLAG_IPV6 requires an IPv6 address
if (filter_var($ipv4, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
    echo "'{$ipv4}' is a valid IPv6 address.<br>";
} else {
    echo "'{$ipv4}' is NOT a valid IPv6 address (using IPv6 flag).<br>";
}

?>

Validate URL - Must Contain Query String

Use the FILTER_FLAG_QUERY_REQUIRED flag with FILTER_VALIDATE_URL.

<?php

$urlWithQuery = "https://example.com/search?q=php";
$urlWithoutQuery = "https://example.com/";

// Check if URL is valid AND has a query string
if (filter_var($urlWithQuery, FILTER_VALIDATE_URL, FILTER_FLAG_QUERY_REQUIRED)) {
    echo "'{$urlWithQuery}' is a valid URL with a query string.<br>";
} else {
    echo "'{$urlWithQuery}' is NOT a valid URL with a query string.<br>";
}

// This will fail because it lacks a query string
if (filter_var($urlWithoutQuery, FILTER_VALIDATE_URL, FILTER_FLAG_QUERY_REQUIRED)) {
    echo "'{$urlWithoutQuery}' is a valid URL with a query string.<br>";
} else {
    echo "'{$urlWithoutQuery}' is NOT a valid URL with a query string.<br>";
}

?>

Validate Email with Unicode Characters

Use the FILTER_FLAG_EMAIL_UNICODE flag (available since PHP 7.1) to allow Unicode characters in the local part of an email address.

<?php

$unicodeEmail = 'josé.philipe@example.com';

// Standard validation might fail depending on PHP version and config
if (filter_var($unicodeEmail, FILTER_VALIDATE_EMAIL)) {
    echo "'{$unicodeEmail}' passes standard validation.<br>";
} else {
    echo "'{$unicodeEmail}' fails standard validation.<br>";
}

// Using the flag to explicitly allow Unicode
if (filter_var($unicodeEmail, FILTER_VALIDATE_EMAIL, FILTER_FLAG_EMAIL_UNICODE)) {
    echo "'{$unicodeEmail}' passes validation with Unicode flag.<br>";
} else {
    echo "'{$unicodeEmail}' fails validation with Unicode flag.<br>";
}

?>

Note on Deprecated Flags: Flags like FILTER_FLAG_STRIP_LOW, FILTER_FLAG_STRIP_HIGH, and FILTER_FLAG_ENCODE_HIGH (often used with the deprecated FILTER_SANITIZE_STRING) are also deprecated or removed in recent PHP versions. For tasks like removing control characters or handling character encoding, use appropriate string functions (e.g., preg_replace, mb_convert_encoding) or dedicated libraries.

Filtering Input Arrays

PHP provides functions to apply filters to entire input arrays like $_GET, $_POST, $_COOKIE, $_SERVER, and $_ENV more efficiently.

filter_input(): Gets a specific external variable by name and optionally filters it.

filter_input_array(): Filters multiple input variables from sources like GET, POST, etc., based on a definition array.

filter_var_array(): Filters multiple values within an existing array based on a definition array.

Example using filter_input_array() with $_POST:

Assume an HTML form submits ‘email’, ‘age’, and ‘website’ via POST.

<?php

// Define the filters to apply to the POST data
$filter_definition = [
    'email' => FILTER_VALIDATE_EMAIL,
    'age'   => [
        'filter' => FILTER_VALIDATE_INT,
        'options' => ['min_range' => 1, 'max_range' => 120]
    ],
    'website' => FILTER_VALIDATE_URL,
    'comment' => [
        'filter' => FILTER_SANITIZE_SPECIAL_CHARS // Sanitize comments
    ]
];

// Apply the filters to the POST superglobal
$filtered_post = filter_input_array(INPUT_POST, $filter_definition);

// Check the results
if ($filtered_post !== null) {
    var_dump($filtered_post);

    // Example check for a specific field's validity
    if ($filtered_post['age'] === false) {
        echo "<p>Invalid age provided (must be between 1 and 120).</p>";
    }
    if ($filtered_post['email'] === false) {
        echo "<p>Invalid email address format.</p>";
    }
} else {
    echo "<p>No POST data received or error during filtering.</p>";
}

?>

This approach provides a structured way to validate and sanitize multiple inputs simultaneously.

Complete PHP Filter Reference

For detailed information on all available filters, flags, options, and functions, refer to the official PHP documentation:

• PHP Filter Extension Manual
• Filter Flags
• filter_input_array() Function
• filter_var_array() Function