filter_var()

Also Known As

TL;DR

Explanation

filter_var($value, FILTER_VALIDATE_*) validates and optionally sanitises input against a wide range of types. FILTER_VALIDATE_URL checks URL structure; FILTER_VALIDATE_EMAIL checks email format; FILTER_VALIDATE_IP validates IP addresses. Sanitise filters (FILTER_SANITIZE_*) remove or encode unwanted characters. Note that FILTER_VALIDATE_URL accepts javascript: and data: URIs — additional checks are needed when the URL will be used in a redirect or src attribute.

Common Misconception

Why It Matters

Common Mistakes

• Using FILTER_SANITIZE_* and treating the output as validated input — sanitisation removes characters, it does not validate semantics.
• Using FILTER_VALIDATE_EMAIL and treating a valid result as deliverable — it validates format, not existence.
• Not passing flags to FILTER_VALIDATE_INT to restrict range — validates as integer but allows negative or huge values.
• Using filter_var for URL validation in security contexts — it accepts javascript: and data: URLs which are dangerous.

Code Examples

// Sanitise then use without validation:
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
sendEmail($email); // Sanitised but may still not be a valid address

// Validate then use:
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) throw new InvalidArgumentException('...');

// Validate
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
if ($email === false) { throw new \InvalidArgumentException('Invalid email'); }

$url = filter_var($_POST['url'], FILTER_VALIDATE_URL);
$ip  = filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4);
$int = filter_var($_GET['page'], FILTER_VALIDATE_INT, ['options' => ['min_range' => 1]]);

// Sanitise (removes dangerous chars — less reliable than allow-listing)
$clean = filter_var($input, FILTER_SANITIZE_SPECIAL_CHARS);

// filter_input reads from superglobals safely
$page = filter_input(INPUT_GET, 'page', FILTER_VALIDATE_INT) ?? 1;

References

• ↗ https://www.php.net/manual/en/function.filter-var.php

Tags

Related Terms