Input Validation: Using filter_var() Over Regular Expressions

February 7, 2009

Just about the biggest time-sink on any project, is the amount of input validation that needs to be done. You _have_ to assume your visitor is a maniac serial killer , out to destroy your application. And you have to prevent it.

Thus starts our never-ending battle for user input validation. We can’t allow it all (think XSS or SQL Injection ), so we check every value presented to us. Correct e-mail formats, IP’s, integers, HTML-code, ….

For a long time, a generic E-mail validation Regular Expression looked like this.

$filter = "^[_a-z0-9-]+(.[_a-z0-9-]+)*@[a-z0-9-]+(.[a-z0-9-]+)*(.[a-z]{2,4})$";
if (!eregi($filter, $user_email)) {
	echo "Invalid e-mail address.";
}

But using PHP’s filter_var function, this can be made 100x easier!

if (!filter_var($user_email, FILTER_VALIDATE_EMAIL)) {
	echo "Invalid e-mail";
}

By passing the correct argument to the filter_var($input, $type); function, we can very quickly determine if the supplied input-variable is compliant with the input we asked, and require.

Some validation-types also allow you to pass in an extra “flag”. Similar to certain “settings” for the validation. It’s often easier to explain this in code, so here’s an example.

$user_url = "google.be";        // Requires input with 'http://'
if (!filter_var($user_url, FILTER_VALIDATE_URL, FILTER_FLAG_SCHEME_REQUIRED)) {
	echo "Invalid URL";
}

And there’s more. While there are quite a few FILTER_VALIDATE_* options, there are also FILTER_SANITIZE_* filters. These are ment to not only validate the input, but alter the input so it is compliant with the given filter.

// $user_int: the tainted input string, which needs cleansing
// $sanitized_int: the input string, stripped from anything but numbers and operators
$user_int = "1+7-3=5 and then do - 5 + 4 which equals: 4";
$sanitized_int = filter_var($user_int, FILTER_SANITIZE_NUMBER_INT);

// Results in: 1+7-35-5+44

Because PHP’s Manual pages on filter_var() don’t include a detailed list of possible validation & sanitation constants , here they are listed – with help from W3Schools.com .

Sanitizing input

FILTER_SANITIZE_STRING: This filter removes data that is potentially harmful for your application. It is used to strip tags and remove or encode unwanted characters.

Optional flags available:
- FILTER_FLAG_NO_ENCODE_QUOTES – This flag does not encode quotes
- FILTER_FLAG_STRIP_LOW – Strip characters with ASCII value below 32
- FILTER_FLAG_STRIP_HIGH – Strip characters with ASCII value above 127
- FILTER_FLAG_ENCODE_LOW – Encode characters with ASCII value below 32
- FILTER_FLAG_ENCODE_HIGH – Encode characters with ASCII value above 127
- FILTER_FLAG_ENCODE_AMP – Encode the & character to &
FILTER_SANITIZE_STRIPPED: Alias to the FILTER_SANITIZE_STRING, shown above.
FILTER_SANITIZE_ENCODED: Filter strips or URL-encodes unwanted characters. Similar to urlencode() .

Optional flags available:
- FILTER_FLAG_STRIP_LOW – Strip characters with ASCII value below 32
- FILTER_FLAG_STRIP_HIGH – Strip characters with ASCII value above 32
- FILTER_FLAG_ENCODE_LOW – Encode characters with ASCII value below 32
- FILTER_FLAG_ENCODE_HIGH – Encode characters with ASCII value above 32
FILTER_SANITIZE_SPECIAL_CHARS: Filter HTML-escapes special characters.

Optional flags available:
- FILTER_FLAG_STRIP_LOW – Strip characters with ASCII value below 32
- FILTER_FLAG_STRIP_HIGH – Strip characters with ASCII value above 32
- FILTER_FLAG_ENCODE_HIGH – Encode characters with ASCII value above 32
FILTER_SANITIZE_EMAIL: Filter removes all illegal e-mail characters from a string.
FILTER_SANITIZE_URL: Filter removes all illegal URL characters from a string.
FILTER_SANITIZE_NUMBER_INT: Filter removes all illegal characters from a number.
FILTER_SANITIZE_NUMBER_FLOAT: Filter removes all illegal characters from a float number.
FILTER_SANITIZE_MAGIC_QUOTES: Filter performs the addslashes() function to a string.

Validating input

FILTER_VALIDATE_INT: Validates value as integer.

Optional flags available:
- min_range – specifies the minimum integer value (code example )
- max_range – specifies the maximum integer value
- FILTER_FLAG_ALLOW_OCTAL – allows octal number values
- FILTER_FLAG_ALLOW_HEX – allows hexadecimal number values
FILTER_VALIDATE_BOOLEAN: Validates value as a boolean option.
FILTER_VALIDATE_FLOAT: Validates value as a float number.
FILTER_VALIDATE_REGEXP: Validates value against a Perl-compatible regular expression.
FILTER_VALIDATE_URL: Validates value as an URL.

Optional flags available:
- FILTER_FLAG_SCHEME_REQUIRED – Requires URL to be an RFC compliant URL (like http://example)
- FILTER_FLAG_HOST_REQUIRED – Requires URL to include host name (like http://www.example.com )
- FILTER_FLAG_PATH_REQUIRED – Requires URL to have a path after the domain name (like www.example.com/example1/test2/ )
- FILTER_FLAG_QUERY_REQUIRED – Requires URL to have a query string (like “example.php?name=Peter&age=37”)
FILTER_VALIDATE_EMAIL: Validates value as an e-mail address.
FILTER_VALIDATE_IP: Validates value as an IPv4 or IPv6 address.

Optional flags available:
- FILTER_FLAG_IPV4 – Requires the value to be a valid IPv4 IP (like 255.255.255.255)
- FILTER_FLAG_IPV6 – Requires the value to be a valid IPv6 IP (like 2001:0db8:85a3:08d3:1319:8a2e:0370:7334)
- FILTER_FLAG_NO_PRIV_RANGE – Requires the value to be a RFC specified IP, not within a private range (like 192.168.0.1, 10.0.0.1, …)
- FILTER_FLAG_NO_RES_RANGE – Requires that the value is not within the reserved IP range. This flag takes both IPV4 and IPV6 values. A reserved IP could be 255.255.255.255 (broadcast address).

An excellent source for more code examples can be found at the Devolio blog post Data Filtering Using PHPs Filter Functions (Part One) .

While the filter_var() functions can’t replace every possible type of input validation, it can help a great deal. Especially tricky validations such as E-mail, URL or IPv6 addresses are so much easier this way.