PHP Filters

# PHP Filters

The PHP filters is used to sanitize and validate and data coming from insecure sources, like user input.

## PHP Filter Functions

Since PHP 5.2.0, the filter functions are enabled by default. You can use them directly in your code without any further installation.

| Function               | Description                                                         |
| ---------------------- | ------------------------------------------------------------------- |
| filter\_has\_var()     | Checks if variable of specified type exists                         |
| filter\_id()           | Returns the ID number of a specified filter                         |
| filter\_input()        | Gets a specific external variable by name and optionally filters it |
| filter\_input\_array() | Gets multiple external variables and optionally filters them        |
| filter\_list()         | Returns an array of all supported filters                           |
| filter\_var\_array()   | Gets multiple variables and optionally filters them                 |
| filter\_var()          | Filters a variable with a specified filter                          |

## PHP Sanitize Filters

The sanitize filters are used to sanitize or clean the user inputs.

| ID                               | Description                                                                                                            |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| FILTER\_SANITIZE\_EMAIL          | Remove all characters except letters, digits and`!#$%&’*+-/=?^_`{\|}~@.[]`                                            |
| FILTER\_SANITIZE\_ENCODED        | URL-encode string, optionally strip or encode special characters.                                                      |
| FILTER\_SANITIZE\_MAGIC\_QUOTES  | Apply`addslashes()`.                                                                                                   |
| FILTER\_SANITIZE\_NUMBER\_FLOAT  | Remove all characters except digits, +- and optionally .,eE                                                            |
| FILTER\_SANITIZE\_NUMBER\_INT    | Remove all characters except digits, plus (+) and minus (-) sign.                                                      |
| FILTER\_SANITIZE\_SPECIAL\_CHARS | HTML-escape ‘“<>& and characters with ASCII value less than 32, optionally strip or encode other special characters. |
| FILTER\_SANITIZE\_STRING         | Strip tags, optionally strip or encode special characters.                                                             |
| FILTER\_SANITIZE\_STRIPPED       | Alias of “string” filter.                                                                                            |
| FILTER\_SANITIZE\_URL            | Remove all characters except letters, digits and`$-_.+!*’(),{}|\\^~[]`<>#%”;/?:@&=`                                  |
| FILTER\_UNSAFE\_RAW              | Do nothing, optionally strip or encode special characters.                                                             |

## Validate Filters

The sanitize filters are used to validate the user inputs.

| ID                        | Description                                                                                         |
| ------------------------- | --------------------------------------------------------------------------------------------------- |
| FILTER\_VALIDATE\_BOOLEAN | Returns TRUE for “1”, “true”, “on” and “yes”. Returns FALSE otherwise.                      |
| FILTER\_VALIDATE\_EMAIL   | Validates value as e-mail.                                                                          |
| FILTER\_VALIDATE\_FLOAT   | Validates value as float.                                                                           |
| FILTER\_VALIDATE\_INT     | Validates value as integer optionally from the specified range.                                     |
| FILTER\_VALIDATE\_IP      | Validates value as IP address, optionally only IPv4 or IPv6 or not from private or reserved ranges. |
| FILTER\_VALIDATE\_REGEXP  | Validates value against regexp, a Perl-compatible regular expression.                               |
| FILTER\_VALIDATE\_URL     | Validates value as URL, optionally with required components.                                        |

Last modification：September 15, 2024