PHP filter

<?php
$int = 123;
if(!filter_var($int, FILTER_VALIDATE_INT))
{
echo("不是一个合法的整数");
}
else
{
echo("是个合法的整数");
}
?>

If we try to use a non-integer variable (such as "123abc"), it will output: "Integer is not valid".

For a complete list of functions and filters, visit our PHP Filter Reference Manual.

Validating and Sanitizing

There are two types of filters:

Validating filter:

• Use For validating user input

• Strict formatting rules (such as URL or E-Mail verification)

• If successful, return the expected type, if Returns FALSE on failure

Sanitizing filter:

• is used to allow or prohibit the specified characters in the string

• No data format rules

• Always returns a string

Options and flags

Options and flags are used to add additional filtering options to the specified filter.

Different filters have different options and flags.

In the example below, we validate an integer using filter_var() with the "min_range" and "max_range" options:

<?php
$var=300;
$int_options = array(
"options"=>array
(
"min_range"=>0,
"max_range"=>256
)
);
if(!filter_var($var, FILTER_VALIDATE_INT, $int_options))
{
echo("不是一个合法的整数");
}
else
{
echo("是个合法的整数");
}
?>

Since the integer is "300", which is not within the specified range, the output of the above code will be:

不是一个合法的整数

To see the complete list of functions and filters, please visit Our PHP Filter reference manual. You can see the available options and flags for each filter.

Validating Input

Let's try to validate the input from the form.

The first thing we need to do is confirm that the input data we are looking for exists.

Then we use the filter_input() function to filter the input data.

In the following example, the input variable "email" is passed to the PHP page:

<?php
if(!filter_has_var(INPUT_GET, "email"))
{
echo("没有 email 参数");
}
else
{
if (!filter_input(INPUT_GET, "email", FILTER_VALIDATE_EMAIL))
{
echo "不是一个合法的 E-Mail";
}
else
{
echo "是一个合法的 E-Mail";
}
}
?>

Explanation of examples

The above example has an input variable (email) transmitted through the "GET" method:

1. Detect whether "GET" exists Input variable of type "email"

1. 2. If an input variable exists, check whether it is a valid e-mail address

Sanitize input

Let’s try to clean up the URL passed from the form.

First, we need to confirm that the input data we are looking for exists.

Then, we use the filter_input() function to purify the input data.

In the following example, the input variable "url" is passed to the PHP page:

<?php
if(!filter_has_var(INPUT_GET, "url"))
{
echo("没有 url 参数");
}
else
{
$url = filter_input(INPUT_GET, 
"url", FILTER_SANITIZE_URL);
echo $url;
}
?>

Explanation of examples

The above example has an input variable (url) transmitted through the "GET" method:

1. Detect whether "GET" exists Input variable of type "url"

2. If this input variable exists, it is sanitized (illegal characters removed) and stored in the $url variable

If the input variable is a string similar to this: "http://www.pååhøøp.cn/", then the purified $url variable will look like this:

Filter multiple inputs

Forms usually consist of multiple input fields. To avoid repeated calls to filter_var or filter_input functions, we can use filter_var_array or the filter_input_array function.

In this example, we use the filter_input_array() function to filter three GET variables. The received GET variables are a name, an age and an e-mail address:

<?php
$filters = array
(
"name" => array
(
"filter"=>FILTER_SANITIZE_STRING
),
"age" => array
(
"filter"=>FILTER_VALIDATE_INT,
"options"=>array
(
"min_range"=>1,
"max_range"=>120
)
),
"email"=> FILTER_VALIDATE_EMAIL
);
$result = filter_input_array(INPUT_GET, $filters);
if (!$result["age"])
{
echo("年龄必须在 1 到 120 之间。<br>");
}
elseif(!$result["email"])
{
echo("E-Mail 不合法<br>");
}
else
{
echo("输入正确");
}
?>

Explanation of examples

There are three examples above Input variables (name, age, and email) passed via the "GET" method:

1. Set an array containing the names of the input variables and the filter for the specified input variable

2. Call the filter_input_array() function, the parameters include the GET input variable and the array just set

3. Detect the "age" and "age" in the $result variable Is there any illegal input to the "email" variable? (If there is an illegal input, the input variable is FALSE after using the filter_input_array() function.)

The second parameter of the filter_input_array() function can be an array or the ID of a single filter. .

If this parameter is the ID of a single filter, then the specified filter will filter all values ​​in the input array.

If the parameter is an array, then the array must follow the following rules:

• Must be an associative array in which the input variables are the keys of the array ( For example, "age" input variable)

• The value of this array must be the ID of the filter, or an array specifying the filter, flags, and options

Using Filter Callback

By using the FILTER_CALLBACK filter, you can call a custom function and use it as a filter. This way, we have full control over data filtering.

You can create your own custom function or use an existing PHP function.

Specify the function of the filter you are going to use according to the specified method of the specified option. In an associative array, with the name "options".

In the following example, we use a custom function to convert all "_" to spaces:

<?php
function convertSpace($string)
{
return str_replace("_", ".", $string);
}
$string = "www_php_cn!";
echo filter_var($string, FILTER_CALLBACK,
array("options"=>"convertSpace"));
?>

Explanation of examples

The above example converts all "_" into ".":

1. Create a " _" replaced by "." The function

2. calls the filter_var() function, whose parameters are the FILTER_CALLBACK filter and the array containing our function