PHP filter_input() Function

PHP

PHP filter_input() - Get External Variable

The filter_input() function in PHP is a powerful and secure way to get and validate external input variables such as GET, POST, and COOKIE data. It helps in sanitizing user input to prevent common security pitfalls like XSS, SQL Injection, and malformed data errors by applying filters directly when retrieving input.

Introduction

PHP provides multiple mechanisms to collect external input coming from users or clients. While accessing superglobals like $_GET, $_POST, or $_COOKIE arrays directly works, it exposes your application to risks if the data is not sanitized or validated.

The filter_input() function is part of the PHP filter extension and offers a robust, consistent, and easy-to-use approach to retrieving specific external variables with optional validation and sanitization in one step.

Prerequisites

  • PHP version 5.2.0 or higher (recommended PHP 7.x or 8.x for better support)
  • Basic knowledge of PHP syntax and superglobals ($_GET, $_POST, $_COOKIE)
  • Understanding of HTTP request types
  • Basic understanding of data validation and sanitization concepts

Setup Steps

  1. Ensure your PHP environment is properly installed and configured.
  2. Create a PHP script to handle incoming external inputs.
  3. Use the filter_input() function to retrieve and filter data from INPUT_GET, INPUT_POST, or INPUT_COOKIE.

Understanding filter_input() Function

The basic syntax of the function is: 

filter_input(
    int $type,
    string $variable_name,
    int $filter = FILTER_DEFAULT,
    array|int $options = 0
): mixed
  • $type: The input type to get data from. Use predefined constants: INPUT_GET, INPUT_POST, INPUT_COOKIE, INPUT_SERVER, or INPUT_ENV.
  • $variable_name: The name of the external variable to get.
  • $filter: The ID of the filter to apply. Defaults to FILTER_DEFAULT (no filtering).
  • $options: Optional flags or additional options like validation flags or filter parameters.

Practical Examples

Example 1: Get and sanitize a GET variable

This example retrieves a user's name from the URL query and sanitizes it as a string.

<?php
// URL: script.php?name=JohnDoe
$name = filter_input(INPUT_GET, 'name', FILTER_SANITIZE_STRING);

if ($name !== null && $name !== false) {
    echo "Hello, " . htmlspecialchars($name);
} else {
    echo "Name parameter is missing or invalid.";
}
?>

Example 2: Validate a POST variable as an integer

This example checks if the POST variable 'age' is a valid integer.

<?php
// Assume data posted from a form via POST method
$age = filter_input(INPUT_POST, 'age', FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 1, 'max_range' => 120]
]);

if ($age === false) {
    echo "Invalid age entered.";
} elseif ($age === null) {
    echo "Age parameter is missing.";
} else {
    echo "Your age is " . $age;
}
?>

Example 3: Get and validate a COOKIE value

Here, we check if a cookie named 'user_id' is a positive integer.

<?php
$userId = filter_input(INPUT_COOKIE, 'user_id', FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 1]
]);

if ($userId) {
    echo "User ID from cookie: " . $userId;
} else {
    echo "No valid user ID cookie found.";
}
?>

Best Practices

  • Always use filter_input() instead of directly accessing superglobals to ensure filtering and validation.
  • Choose the most appropriate filter for the expected data type (e.g., FILTER_VALIDATE_INT for numbers, FILTER_VALIDATE_EMAIL for emails).
  • Use FILTER_SANITIZE_* filters when input is meant to be cleaned but not fully validated.
  • Check for false and null explicitly when the return can be either (false = filter failed, null = variable missing).
  • Combine filter_input() with additional validation logic if needed, such as regular expressions, length checks, or custom sanitization.

Common Mistakes

  • Assuming that filter_input() will always return a non-false value without checks.
  • Using incorrect INPUT_* type constants for the source of the input variable.
  • Not verifying if the variable exists before using its value (null vs false distinction).
  • Relying on FILTER_SANITIZE_STRING without understanding it only removes some tags but does not validate data format.
  • Attempting to filter input data that comes from arrays directly without using filter_input_array().

Interview Questions

Junior-Level Questions

  • Q1: What does the filter_input() function do?
    A: It retrieves a specific external variable (GET, POST, COOKIE, etc.) and optionally filters or validates it.
  • Q2: Which constants can be used as the first argument in filter_input()?
    A: INPUT_GET, INPUT_POST, INPUT_COOKIE, INPUT_SERVER, and INPUT_ENV.
  • Q3: What does the function return if the variable does not exist?
    A: It returns null.
  • Q4: How do you validate an email using filter_input()?
    A: Use FILTER_VALIDATE_EMAIL as the filter argument.
  • Q5: Is it safe to use $_GET['var'] instead of filter_input()?
    A: No, because $_GET does not automatically filter or sanitize the input.

Mid-Level Questions

  • Q1: What is the difference between FILTER_SANITIZE_STRING and FILTER_VALIDATE_INT?
    A: FILTER_SANITIZE_STRING cleans a string, while FILTER_VALIDATE_INT checks if a value is a valid integer.
  • Q2: How do you specify options like min and max range when validating integers using filter_input()?
    A: Pass an array with 'options' key specifying 'min_range' and 'max_range' in the fourth parameter.
  • Q3: Can you filter an array variable using filter_input()?
    A: No, you need to use filter_input_array() for arrays.
  • Q4: What does it mean if filter_input() returns false?
    A: The input variable failed the applied filter or validation.
  • Q5: Why might filter_input() return null even if you expect the input to be present?
    A: The input variable does not exist or is not set in the specified input type.

Senior-Level Questions

  • Q1: How does filter_input() improve security compared to manual sanitization?
    A: It applies standardized filters early, reduces human error, and prevents injection attacks by validating/sanitizing inputs on retrieval.
  • Q2: Explain a scenario where filter_input() alone is not enough.
    A: When data requires context-aware validation (e.g., validating complex JSON strings or business rules), additional logic beyond simple filtering is needed.
  • Q3: How does PHP internally handle filtering in filter_input()?
    A: It uses the filter extension backed by C-based implementations for efficient and consistent filtering of inputs from predefined sources.
  • Q4: Can filter_input() be used with custom user-defined filters?
    A: Not directly; it works with built-in filters, but custom validation can be applied after retrieving input.
  • Q5: How to handle multi-dimensional or nested GET/POST variables with filter_input()?
    A: Since filter_input() only works with scalar variables, use filter_input_array() or manual validation for nested inputs.

Frequently Asked Questions (FAQ)

Q1: What happens if I use an invalid filter in filter_input()?

PHP will default to FILTER_DEFAULT if the filter is invalid. This behaves like no filtering. It’s important to use valid filters.

Q2: Can filter_input() sanitize multiple inputs simultaneously?

No, to sanitize or validate multiple variables at once, use filter_input_array().

Q3: Is filter_input() suitable for inputs other than GET and POST?

Yes, it can also filter COOKIE, SERVER, and ENV variables as well.

Q4: How does filter_input() affect application security?

It reduces injection vulnerabilities by validating and sanitizing incoming data before it’s used in scripts.

Q5: Can you modify or sanitize input data after fetching it using filter_input()?

Yes. You can apply additional PHP functions or custom sanitization after the input is obtained from filter_input().

Conclusion

The PHP filter_input() function is an essential tool for working securely with external variables such as GET, POST, and COOKIE data. Its ease of use combined with powerful filtering and validation capabilities allows developers to write cleaner, safer, and more maintainable code.

Employing filter_input() in your PHP projects improves security by reducing the risk of malicious data propagation and enables better input control. By following best practices and understanding its nuances, you can leverage filter_input() to build robust, user-friendly applications.