PHP - Filter
The filter extension provides tool to filter data by either validating or sanitizing it. This is especially useful when the data source contains unknown (or foreign) data, like user supplied input in a HTML form.
There are two main types of filtering: validation and sanitization.
Validation is used to validate if the data meets certain qualifications. For example, passing in FILTER_VALIDATE_EMAIL will determine if the data is a valid email address. But this will not change the data itself.
Sanitization will sanitize the data and may alter it by removing undesired characters. For example, passing in FILTER_SANITIZE_EMAIL will remove characters that are inappropriate for an email address to contain. But this will not validate the data.
Flags are optionally used with both validation and sanitization to tweak behavior according to need. For example, passing in FILTER_FLAG_PATH_REQUIRED while filtering an URL will require a path to be present.
Installation
The filter extension is enabled by default. To disable the filter extension, use --disable-filter.
There is no installation needed to use these functions. These functions are part of the PHP core.
Runtime Configuration
The behavior of these functions is affected by settings in php.ini.
Filter Configuration Options
| Name | Default | Description | Changeable |
|---|---|---|---|
| filter.default | "unsafe_raw" | Filter all $_GET, $_POST, $_COOKIE, $_REQUEST and $_SERVER data by this filter. Original data can be accessed through filter_input(). Accepts the name of the filter you like to use by default. See the existing filter list for the list of the filter names. | PHP_INI_PERDIR |
| filter.default_flags | NULL | Default flags to apply when the default filter is set. This is set to FILTER_FLAG_NO_ENCODE_QUOTES by default for backwards compatibility reasons. | PHP_INI_PERDIR |
Types of filters
PHP Filter Functions
| Functions | Description |
|---|---|
| filter_has_var() | Checks if variable of specified type exists. |
| filter_id() | Returns the filter ID belonging to a named filter. |
| filter_input() | Gets a specific external variable by name and optionally filters it. |
| filter_input_array() | Gets external variables and optionally filters them. |
| filter_list() | Returns a list of all supported filters. |
| filter_var_array() | Gets multiple variables and optionally filters them. |
| filter_var() | Filters a variable with a specified filter. |
PHP Filter Predefined Constants
The constants below are defined by this extension, and will only be available when the extension has either been compiled into PHP or dynamically loaded at runtime.
| Constants | Type | Description |
|---|---|---|
| INPUT_POST | Integer | POST variables. |
| INPUT_GET | Integer | GET variables. |
| INPUT_COOKIE | Integer | COOKIE variables. |
| INPUT_ENV | Integer | ENV variables. |
| INPUT_SERVER | Integer | SERVER variables. |
| INPUT_SESSION | Integer | SESSION variables. (not implemented yet) |
| INPUT_REQUEST | Integer | REQUEST variables. (not implemented yet) |
| FILTER_FLAG_NONE | Integer | No flags. |
| FILTER_REQUIRE_SCALAR | Integer | Flag used to require scalar as input |
| FILTER_REQUIRE_ARRAY | Integer | Require an array as input. |
| FILTER_FORCE_ARRAY | Integer | Always returns an array. |
| FILTER_NULL_ON_FAILURE | Integer | Use NULL instead of FALSE on failure. |
| FILTER_VALIDATE_INT | Integer | ID of "int" filter. |
| FILTER_VALIDATE_BOOL | Integer | Alias of FILTER_VALIDATE_BOOLEAN. |
| FILTER_VALIDATE_BOOLEAN | Integer | ID of "boolean" filter. |
| FILTER_VALIDATE_FLOAT | Integer | ID of "float" filter. |
| FILTER_VALIDATE_REGEXP | Integer | ID of "validate_regexp" filter. |
| FILTER_VALIDATE_URL | Integer | ID of "validate_url" filter. |
| FILTER_VALIDATE_DOMAIN | Integer | ID of "validate_domain" filter. (Available as of PHP 7.0.0) |
| FILTER_VALIDATE_EMAIL | Integer | ID of "validate_email" filter. |
| FILTER_VALIDATE_IP | Integer | ID of "validate_ip" filter. |
| FILTER_VALIDATE_MAC | Integer | ID of "validate_mac_address" filter. |
| FILTER_DEFAULT | Integer | ID of default ("unsafe_raw") filter. This is equivalent to FILTER_UNSAFE_RAW. |
| FILTER_UNSAFE_RAW | Integer | ID of "unsafe_raw" filter. |
| FILTER_SANITIZE_STRING | Integer | ID of "string" filter. |
| FILTER_SANITIZE_STRIPPED | Integer | ID of "stripped" filter. |
| FILTER_SANITIZE_ENCODED | Integer | ID of "encoded" filter. |
| FILTER_SANITIZE_SPECIAL_CHARS | Integer | ID of "special_chars" filter. |
| FILTER_SANITIZE_EMAIL | Integer | ID of "email" filter. |
| FILTER_SANITIZE_URL | Integer | ID of "url" filter. |
| FILTER_SANITIZE_NUMBER_INT | Integer | ID of "number_int" filter. |
| FILTER_SANITIZE_NUMBER_FLOAT | Integer | ID of "number_float" filter. |
| FILTER_SANITIZE_MAGIC_QUOTES | Integer | ID of "magic_quotes" filter. (DEPRECATED as of PHP 7.3.0 and REMOVED as of PHP 8.0.0, use FILTER_SANITIZE_ADD_SLASHES instead.) |
| FILTER_SANITIZE_ADD_SLASHES | Integer | ID of "add_slashes" filter. (Available as of PHP 7.3.0) |
| FILTER_CALLBACK | Integer | ID of "callback" filter. |
| FILTER_FLAG_ALLOW_OCTAL | Integer | Allow octal notation (0[0-7]+) in "int" filter. |
| FILTER_FLAG_ALLOW_HEX | Integer | Allow hex notation (0x[0-9a-fA-F]+) in "int" filter. |
| FILTER_FLAG_STRIP_LOW | Integer | Strip characters with ASCII value less than 32. |
| FILTER_FLAG_STRIP_HIGH | Integer | Strip characters with ASCII value greater than 127. |
| FILTER_FLAG_STRIP_BACKTICK | Integer | Strips backtick characters. |
| FILTER_FLAG_ENCODE_LOW | Integer | Encode characters with ASCII value less than 32. |
| FILTER_FLAG_ENCODE_HIGH | Integer | Encode characters with ASCII value greater than 127. |
| FILTER_FLAG_ENCODE_AMP | Integer | Encode &. |
| FILTER_FLAG_NO_ENCODE_QUOTES | Integer | Don't encode ' and ". |
| FILTER_FLAG_EMPTY_STRING_NULL | Integer | (No use for now.) |
| FILTER_FLAG_ALLOW_FRACTION | Integer | Allow fractional part in "number_float" filter. |
| FILTER_FLAG_ALLOW_THOUSAND | Integer | Allow thousand separator (,) in "number_float" filter. |
| FILTER_FLAG_ALLOW_SCIENTIFIC | Integer | Allow scientific notation (e, E) in "number_float" filter. |
| FILTER_FLAG_PATH_REQUIRED | Integer | Require path in "validate_url" filter. |
| FILTER_FLAG_QUERY_REQUIRED | Integer | Require query in "validate_url" filter. |
| FILTER_FLAG_SCHEME_REQUIRED | Integer | Require scheme in "validate_url" filter. (Deprecated per PHP 7.3 as it is implied in the filter already.) |
| FILTER_FLAG_HOST_REQUIRED | Integer | Require host in "validate_url" filter. (Deprecated per PHP 7.3 as it is implied in the filter already.) |
| FILTER_FLAG_HOSTNAME | Integer | Require hostnames to start with an alphanumeric character and contain only alphanumeric characters or hyphens. (Available as of PHP 7.0.0) |
| FILTER_FLAG_IPV4 | Integer | Allow only IPv4 address in "validate_ip" filter. |
| FILTER_FLAG_IPV6 | Integer | Allow only IPv6 address in "validate_ip" filter. |
| FILTER_FLAG_NO_RES_RANGE | Integer | Deny reserved addresses in "validate_ip" filter. |
| FILTER_FLAG_NO_PRIV_RANGE | Integer | Deny private addresses in "validate_ip" filter. |
| FILTER_FLAG_EMAIL_UNICODE | Integer | Accepts Unicode characters in the local part in "validate_email" filter. (Available as of PHP 7.1.0) |
