PHP

What is a PHP Filter?

PHP filters are used to validate and filter data coming from insecure sources, such as user input. Testing, validating and filtering user input or custom data is an important part of every web application, and the PHP filter extension is designed to make data filtering easier and quicker.

Why use a filter?

Almost all web applications depend on external input – usually from a user or from another application (such as a web service). By using filters you can be sure your application gets the correct input type. You should always filter all external data! Input filtering is one of the most important application security issues.

What is external data?

• Input data from a form
• Cookies
• Web services data
• Server variables
• Database query results

Filter Functions

The input types for filter_input() are the constants INPUT_GET, INPUT_POST, INPUT_COOKIE, INPUT_SERVER and INPUT_ENV.

Validating and Sanitizing

There are two kinds of filters:

Validating filters

• are used to validate user input;
• have strict format rules (like URL or e-mail validation);
• return the expected type on success, or false on failure.

Sanitizing filters

• are used to allow or disallow specified characters in a string;
• have no data-format rules;
• always return the (cleaned) string.

Validate filters

Sanitize filters

Validating an Integer – filter_var()

In the example below we validate an integer:

<?php
$int = 123;
if (filter_var($int, FILTER_VALIDATE_INT) === false) {
    echo("Integer is not valid");
} else {
    echo("Integer is valid");
}
?>

Integer is valid

The code uses the FILTER_VALIDATE_INT filter. Since 123 is a valid integer, the output is "Integer is valid". If we try a variable that is not an integer (like "123abc"), the output is "Integer is not valid":

<?php
foreach ([123, "123abc", "45", 0, "7.5"] as $value) {
    $r = filter_var($value, FILTER_VALIDATE_INT);
    echo var_export($value, true) . " → " . ($r === false ? "not valid" : "valid, int $r") . "<br>";
}
?>

123 → valid, int 123
'123abc' → not valid
'45' → valid, int 45
0 → valid, int 0
'7.5' → not valid

Options and Flags

Options and flags add extra filtering behaviour to a filter. Different filters have different options and flags. Below we validate an integer with the min_range and max_range options:

<?php
$var = 300;
$int_options = array(
    "options" => array(
        "min_range" => 0,
        "max_range" => 256
    )
);
if (filter_var($var, FILTER_VALIDATE_INT, $int_options) === false) {
    echo("Integer is not valid");
} else {
    echo("Integer is valid");
}
?>

Integer is not valid

Options must be put in an associative array named "options". A flag can be given directly, or in the "flags" element. Since 300 is not in the range 0–256, the output is "Integer is not valid".

<?php
echo "<pre>";
var_dump(filter_var("192.168.1.10", FILTER_VALIDATE_IP));
var_dump(filter_var("192.168.1.10", FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE));
var_dump(filter_var("yes", FILTER_VALIDATE_BOOLEAN));
var_dump(filter_var("maybe", FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE));
var_dump(filter_var("https://www.php.net/manual", FILTER_VALIDATE_URL, FILTER_FLAG_PATH_REQUIRED));
var_dump(filter_var("1,250.75 rupees", FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION));
var_dump(filter_var("<b>Hi</b> & bye", FILTER_SANITIZE_FULL_SPECIAL_CHARS));
echo "</pre>";
?>

string(12) "192.168.1.10"
bool(false)
bool(true)
NULL
string(26) "https://www.php.net/manual"
string(7) "1250.75"
string(31) "<b>Hi</b> & bye"

The last line returns <b>Hi</b> & bye (31 characters); the browser displays these entities as the original characters, which is exactly why the text is now safe to print.

Validating Input – filter_input()

Let us validate input from a form. First confirm that the input data exists, then filter it with filter_input(). In the example below the input variable "email" is sent to the PHP page with GET:

<?php
if (!filter_has_var(INPUT_GET, "email")) {
    echo("Input type does not exist");
} else {
    if (!filter_input(INPUT_GET, "email", FILTER_VALIDATE_EMAIL)) {
        echo "E-Mail is not valid";
    } else {
        echo "E-Mail is valid";
    }
}
?>

E-Mail is not valid

E-Mail is valid

Example explained: the script checks whether an "email" input variable of the GET type exists; if it does, it checks whether it is a valid e-mail address.

Sanitizing Input

Let us clean up a URL sent from a form. First we confirm that the input exists, then we sanitize it with filter_input(). The input variable "url" is sent with POST:

<?php
if (!filter_has_var(INPUT_POST, "url")) {
    echo("Input type does not exist");
} else {
    $url = filter_input(INPUT_POST, "url", FILTER_SANITIZE_URL);
    echo "Received : " . htmlspecialchars($_POST["url"]) . "<br>";
    echo "Sanitized: " . htmlspecialchars($url);
}
?>

Received : http://www.exämple.com/my page?q=php
Sanitized: http://www.exmple.com/mypage?q=php

The script checks whether the "url" POST input exists; if it does, it removes the invalid characters (here the space and the "ä") and stores the result in $url.

Filtering Multiple Inputs

A form almost always has more than one field. To avoid calling filter_var() or filter_input() again and again, use filter_var_array() or filter_input_array(). In this example filter_input_array() filters three GET variables – a name, an age and an e-mail address:

<?php
$filters = array(
    "name" => array(
        "filter" => FILTER_SANITIZE_FULL_SPECIAL_CHARS
    ),
    "age" => array(
        "filter"  => FILTER_VALIDATE_INT,
        "options" => array(
            "min_range" => 1,
            "max_range" => 120
        )
    ),
    "email" => FILTER_VALIDATE_EMAIL,
);
$result = filter_input_array(INPUT_GET, $filters);
if (!$result["age"]) {
    echo("Age must be a number between 1 and 120.<br>");
} elseif (!$result["email"]) {
    echo("E-Mail is not valid.<br>");
} else {
    echo("User input is valid<br>");
}
echo "<pre>";
var_dump($result);
echo "</pre>";
?>

User input is valid

array(3) {
  ["name"]=>
  string(30) "Asha <b>Sharma</b>"
  ["age"]=>
  int(21)
  ["email"]=>
  string(16) "asha@example.com"
}

Example explained:

1. An array is set containing the names of the input variables and the filters used on them.
2. filter_input_array() is called with the GET input variables and that array.
3. The "age" and "email" elements of $result are checked for invalid input. (If an input is invalid, it is false after filter_input_array().)

The second parameter of filter_input_array() can be an array or a single filter ID. If it is a single filter ID, all values in the input array are filtered with that filter. If it is an array, it must follow these rules:

• It must be an associative array with the input variable names as keys (like "age").
• Each value must be a filter ID, or an array specifying the filter, flags and options.

Using a Filter Callback

With FILTER_CALLBACK you can call a user-defined function and use it as a filter, giving you full control of the data filtering. You can write your own function or use an existing PHP function. The function is specified like an option – in an associative array named "options". In the example below a user-created function converts all "_" to spaces:

<?php
function convertSpace($string)
{
    return str_replace("_", " ", $string);
}
$string = "Bhopal_City_of_Lakes!";
echo filter_var($string, FILTER_CALLBACK, array("options" => "convertSpace"));
echo "<br>";
echo filter_var("  php filters  ", FILTER_CALLBACK, array("options" => "trim"));
?>

Bhopal City of Lakes!
php filters