What is a PHP filter?
PHP filters are used to validate and filter data from non-secure sources.
Testing, validating, and filtering user input or custom data are important parts of any web application.
PHP's filter extension is designed to make data filtering easier and faster.
Why use filters?
Almost all web applications rely on external input. This data usually comes from users or other applications (such as web services). By using filters, you can ensure that your application gets the correct input type.
You should always filter external data!
Input filtering is one of the most important application security topics.
What is external data?
· Input data from the form
# · Cookies
· Web Services data
## · Server variable · Database database Query resultsFunctions and filters
To filter variables, use one of the following filter functions:· filter_var() - Filter a single variable through a specified filter· filter_var_array() - Filter multiple variables through the same or different filters · filter_input - Gets an input variable and filters it· filter_input_array - Gets multiple input variables and filters them through the same or different filters Below In the example, we use the filter_var() function to verify an integer:<?php
$int = 123;
if(!filter_var($int, FILTER_VALIDATE_INT))
{
echo("不是一个合法的整数");
}
else
{
echo("是个合法的整数");
}
?>The above code uses the "FILTER_VALIDATE_INT" filter to filter variables. Since this integer is legal, the above code will output: 
· Number of Data Format Rules
· Always return to the string
<?php
$var=300;
$int_options = array(
"options"=>array
(
"min_range"=>0,
"max_range"=>256
)
);
if(!filter_var($var, FILTER_VALIDATE_INT, $int_options))
{
echo("不是一个合法的整数");
}
else
{
echo("是个合法的整数");
}
?>Like the code above, the options must be put in a in a related array named "options". If using flags, they don't need to be in an array. Since the integer is "300", it is not within the specified range, the output of the above code will be: is not a legal integer To view the complete function and a list of filters, please visit our PHP Filter Reference Manual. You can see the available options and flags for each filter. <?php
if(!filter_has_var(INPUT_GET, "email"))
{
echo("没有 email 参数");
}
else
{
if (!filter_input(INPUT_GET, "email", FILTER_VALIDATE_EMAIL))
{
echo "不是一个合法的 E-Mail";
}
else
{
echo "是一个合法的 E-Mail";
}
}
?>The test results of the above example are as follows: 
Explanation of examples
The above example has an input variable (email) transmitted through the "GET" method: 1. Detect whether there is an "email" input variable of type "GET"2. If an input variable exists, check whether it is a valid e-mail addressSanitize input
Let’s try to clean up the URL passed in from the form. First, we need to confirm that the input data we are looking for exists. Then, we use the filter_input() function to purify the input data. In the following example, the input variable "url" is passed to the PHP page:<?php
if(!filter_has_var(INPUT_GET, "url"))
{
echo("没有 url 参数");
}
else
{
$url = filter_input(INPUT_GET,
"url", FILTER_SANITIZE_URL);
echo $url;
}
?>Explanation of the exampleThe above example has one passed through the "GET" method Input variable (url): 1. Detect whether there is a "GET" type "url" input variable 2. If this input variable exists, purify it (delete illegal characters) , and store it in the $url variableIf the input variable is a string similar to this: "//m.sbmmt.com /", the purified $url variable is as follows ：
##Filter multiple inputs Forms usually consist of multiple input fields. To avoid repeated calls to filter_var or filter_input functions, we can use filter_var_array or the filter_input_array function. In this example, we use the filter_input_array() function to filter three GET variables. The received GET variables are a name, an age and an e-mail address: Example explanation The above example has three input variables (name, age and email): 1. Set up an array that contains the name of the input variable and the filter for the specified input variable 2. Call the filter_input_array() function, the parameters include GET input variable and the array just set 3. Detect whether the "age" and "email" variables in the $result variable have illegal input. (If there is an illegal input, the input variable is FALSE after using the filter_input_array() function.) The second argument to the filter_input_array() function can be an array or the ID of a single filter. If this parameter is the ID of a single filter, then the specified filter will filter all values in the input array. If the parameter is an array, then the array must follow the following rules: · # Variable) · The value of this array must be the ID of the filter, or an array specifying the filter, flags and options Use Filter Callback By using the FILTER_CALLBACK filter, you can call a custom function and use it as a filter. This way, we have full control over data filtering. You can create your own custom function or use an existing PHP function. Specify the function of the filter you are going to use according to the specified method of the specified option. In an associative array, with the name "options". In the following example, we use a custom function to convert all "_" to spaces: The result of the above code is as follows: Example explanation The above example converts all "_" into ". ": 1. Create a function that replaces "_" with "." 2. Call the filter_var() function, whose parameters are the FILTER_CALLBACK filter and the function that contains our function Array <?php
$filters = array
(
"name" => array
(
"filter"=>FILTER_SANITIZE_STRING
),
"age" => array
(
"filter"=>FILTER_VALIDATE_INT,
"options"=>array
(
"min_range"=>1,
"max_range"=>120
)
),
"email"=> FILTER_VALIDATE_EMAIL
);
$result = filter_input_array(INPUT_GET, $filters);
if (!$result["age"])
{
echo("年龄必须在 1 到 120 之间。<br>");
}
elseif(!$result["email"])
{
echo("E-Mail 不合法<br>");
}
else
{
echo("输入正确");
}
?><?php
function convertSpace($string)
{
return str_replace("_", ".", $string);
}
$string = "www_php_cn!";
echo filter_var($string, FILTER_CALLBACK,
array("options"=>"convertSpace"));
?>
