Input Validation: Using filter_var() Over Regular Expressions

Mattias Geniar, Saturday, February 7, 2009 - last modified: Saturday, January 31, 2009

Just about the biggest time-sink on any project, is the amount of input validation that needs to be done. You _have_ to assume your visitor is a maniac serial killer, out to destroy your application. And you have to prevent it.

Thus starts our never-ending battle for user input validation. We can't allow it all (think XSS or SQL Injection), so we check every value presented to us. Correct e-mail formats, IP's, integers, HTML-code, ....

For a long time, a generic E-mail validation Regular Expression looked like this.

$filter = "^[_a-z0-9-]+(.[_a-z0-9-]+)*@[a-z0-9-]+(.[a-z0-9-]+)*(.[a-z]{2,4})$";
if (!eregi($filter, $user_email)) {
	echo "Invalid e-mail address.";

But using PHP's filter_var function, this can be made 100x easier!

if (!filter_var($user_email, FILTER_VALIDATE_EMAIL)) {
	echo "Invalid e-mail";

By passing the correct argument to the filter_var($input, $type); function, we can very quickly determine if the supplied input-variable is compliant with the input we asked, and require.

Some validation-types also allow you to pass in an extra "flag". Similar to certain "settings" for the validation. It's often easier to explain this in code, so here's an example.

$user_url = "";        // Requires input with 'http://'
	echo "Invalid URL";

And there's more. While there are quite a few FILTER_VALIDATE_* options, there are also FILTER_SANITIZE_* filters. These are ment to not only validate the input, but alter the input so it is compliant with the given filter.

// $user_int: the tainted input string, which needs cleansing
// $sanitized_int: the input string, stripped from anything but numbers and operators
$user_int = "1+7-3=5 and then do - 5 + 4 which equals: 4";
$sanitized_int = filter_var($user_int, FILTER_SANITIZE_NUMBER_INT);

// Results in: 1+7-35-5+44

Because PHP's Manual pages on filter_var() don't include a detailed list of possible validation & sanitation constants, here they are listed -- with help from

Sanitizing input

  • FILTER_SANITIZE_STRING: This filter removes data that is potentially harmful for your application. It is used to strip tags and remove or encode unwanted characters.
    Optional flags available:

    • FILTER_FLAG_NO_ENCODE_QUOTES -- This flag does not encode quotes
    • FILTER_FLAG_STRIP_LOW -- Strip characters with ASCII value below 32
    • FILTER_FLAG_STRIP_HIGH -- Strip characters with ASCII value above 127
    • FILTER_FLAG_ENCODE_LOW -- Encode characters with ASCII value below 32
    • FILTER_FLAG_ENCODE_HIGH -- Encode characters with ASCII value above 127
    • FILTER_FLAG_ENCODE_AMP -- Encode the & character to &
  • FILTER_SANITIZE_ENCODED: Filter strips or URL-encodes unwanted characters. Similar to urlencode().
    Optional flags available:

    • FILTER_FLAG_STRIP_LOW -- Strip characters with ASCII value below 32
    • FILTER_FLAG_STRIP_HIGH -- Strip characters with ASCII value above 32
    • FILTER_FLAG_ENCODE_LOW -- Encode characters with ASCII value below 32
    • FILTER_FLAG_ENCODE_HIGH -- Encode characters with ASCII value above 32
  • FILTER_SANITIZE_SPECIAL_CHARS: Filter HTML-escapes special characters.
    Optional flags available:

    • FILTER_FLAG_STRIP_LOW -- Strip characters with ASCII value below 32
    • FILTER_FLAG_STRIP_HIGH -- Strip characters with ASCII value above 32
    • FILTER_FLAG_ENCODE_HIGH -- Encode characters with ASCII value above 32
  • FILTER_SANITIZE_EMAIL: Filter removes all illegal e-mail characters from a string.
  • FILTER_SANITIZE_URL: Filter removes all illegal URL characters from a string.
  • FILTER_SANITIZE_NUMBER_INT: Filter removes all illegal characters from a number.
  • FILTER_SANITIZE_NUMBER_FLOAT: Filter removes all illegal characters from a float number.
  • FILTER_SANITIZE_MAGIC_QUOTES: Filter performs the addslashes() function to a string.

Validating input

  • FILTER_VALIDATE_INT: Validates value as integer.
    Optional flags available:

    • min_range -- specifies the minimum integer value (code example)
    • max_range -- specifies the maximum integer value
    • FILTER_FLAG_ALLOW_OCTAL -- allows octal number values
    • FILTER_FLAG_ALLOW_HEX -- allows hexadecimal number values
  • FILTER_VALIDATE_BOOLEAN: Validates value as a boolean option.
  • FILTER_VALIDATE_FLOAT: Validates value as a float number.
  • FILTER_VALIDATE_REGEXP: Validates value against a Perl-compatible regular expression.
  • FILTER_VALIDATE_URL: Validates value as an URL.
    Optional flags available:

    • FILTER_FLAG_SCHEME_REQUIRED -- Requires URL to be an RFC compliant URL (like http://example)
    • FILTER_FLAG_HOST_REQUIRED -- Requires URL to include host name (like
    • FILTER_FLAG_PATH_REQUIRED -- Requires URL to have a path after the domain name (like
    • FILTER_FLAG_QUERY_REQUIRED -- Requires URL to have a query string (like "example.php?name=Peter&age=37")
  • FILTER_VALIDATE_EMAIL: Validates value as an e-mail address.
  • FILTER_VALIDATE_IP: Validates value as an IPv4 or IPv6 address.
    Optional flags available:

    • FILTER_FLAG_IPV4 -- Requires the value to be a valid IPv4 IP (like
    • FILTER_FLAG_IPV6 -- Requires the value to be a valid IPv6 IP (like 2001:0db8:85a3:08d3:1319:8a2e:0370:7334)
    • FILTER_FLAG_NO_PRIV_RANGE -- Requires the value to be a RFC specified IP, not within a private range (like,, ...)
    • FILTER_FLAG_NO_RES_RANGE -- Requires that the value is not within the reserved IP range. This flag takes both IPV4 and IPV6 values. A reserved IP could be (broadcast address).

An excellent source for more code examples can be found at the Devolio blog post Data Filtering Using PHPs Filter Functions (Part One).

While the filter_var() functions can't replace every possible type of input validation, it can help a great deal. Especially tricky validations such as E-mail, URL or IPv6 addresses are so much easier this way.

Hi! My name is Mattias Geniar. I'm a Support Manager at Nucleus Hosting in Belgium, a general web geek & public speaker. Currently working on DNS Spy & Oh Dear!. Follow me on Twitter as @mattiasgeniar.

Share this post

Did you like this post? Will you help me share it on social media? Thanks!


Anon Wednesday, February 11, 2009 at 11:58 - Reply

Nice article, thanks. I’ve been coding in PHP for several years now and have never heard of this function! Much simpler than using regular expressions.

Matti Wednesday, February 11, 2009 at 13:09 - Reply

@Anon; I’m in the same position, and have only found out about it a couple of months ago. But it sure beats writing those regular expressions, especially when validating IPv6 addresses :-)

It can’t replace everything yet, but it saves me quite some time!

Twigglesbury Wednesday, February 11, 2009 at 13:12 - Reply

On the PHP site the filter constants are here:

Geert Wednesday, February 11, 2009 at 13:58 - Reply

Still I prefer regular expressions. That way you know exactly what you are matching. Of course, be sure to put them in a helper function in order not to repeat the regexes needlessly.

Also, according to a quick benchmark I just ran, regexes for email validation are at least twice as fast as using filter_var().

Matti Wednesday, February 11, 2009 at 14:05 - Reply

@Twigglesbur; there’s a list, but nothing more. It lacks a bit of explanation.

@Geert; performance takes a small dive, but for input validation I wouldn’t make that such a big deal. It’s not like you’ll loop it 1k times, so chances are you won’t ever notice in a big project (unless you’re micro-optimizing, of course).

You have a point in knowing what gets validated, and what doesn’t, but I personally wouldn’t weigh that against the ease of use. Once you get to the point where need specific e-mail validation, you’ll of course have to get back to regex’s.

Dave Thursday, February 12, 2009 at 19:20 - Reply

@Geert: use the FILTER_VALIDATE_REGEXP then :)

I’ve been using the filter extension since the 5.1.X days when it was a PECL extension. Very, very useful. I have it wrapped up in an object wrapper making it even easier to use; though admittedly I probably only use about a tenth of what is possible!

Developer Friday, February 13, 2009 at 01:51 - Reply

I’ve been working on PHP apps for over 5 years now, building out some serious apps and I’ve never seen / heard of this function. In the years I’ve came up with quiet a frankenfunction to do general input filtering, but now I can finally retire it. Thank you!!

Tijuan Sunday, February 15, 2009 at 17:37 - Reply

filter_var was introduced with PHP 5.2, so this is not an old function, but that was one of the big feature of this release.

Have fun and make your life easier with it ! :)

Smily Friday, February 20, 2009 at 06:26 - Reply

I made a similar discovery last year ( note: mine is really old and out of date) except i used filter_input. It definitely is a big help, what made me nervous however was the idea that these functions were experimental. Because of this I ended up putting them inside helper functions so that if it ever did change I would only have to update the functions.

Halycon Prime Tuesday, March 10, 2009 at 23:14 - Reply

eregi() is being removed from PHP for PHP6, should prolly stop using it to prevent future issues.

ruby Wednesday, March 11, 2009 at 13:32 - Reply

just want to ask about input validation. what is the right function that i am going to use if i am validating the user name?

Matti Wednesday, March 11, 2009 at 15:12 - Reply

@Ruby; that depends on your constraints. If you’re only allowing a-Z, a simple regular expression will suffice. Because a “username” isn’t a fixed subject (syntax may vary, depending on the project), I doubt there will be an appropriate filter_var() option for it.

Xynder Sunday, June 7, 2009 at 09:30 - Reply

A Very Good article indeed. I’ve been head over heel trying to fix a email validation that is using a regex before I find this article. Just hoping they would create some to validate credit card number too later on :D

isogashii Thursday, May 27, 2010 at 14:21 - Reply

helpful article, as you said the problem with filter_var documentation that you have to find an example to see explanation of what these FILTER constants mean, you arranged and explained them in a great way.
Thank you.

telecommute php mysql coder Wednesday, June 23, 2010 at 10:09 - Reply


This is nice article. You given the many validate functions its really helping to me..

Thanks a lot..!

Nico Tuesday, January 11, 2011 at 19:04 - Reply

filter_var() accepts emails without TLD. “foo@bar” is considered valid, which kinda makes no sense to me.

Matti Tuesday, January 11, 2011 at 22:56 - Reply

In most cases I would agree, but consider domain (as in: active domain, windows) users with “username@domain” format. Not common in practice, but valid according to RFC’s I believe.

Gary Chambers Thursday, February 24, 2011 at 18:50 - Reply

The filter_var() function in PHP 5.3.2 is broken. It will not permit domain names that contain a hyphen (e.g.

Steve Thursday, February 23, 2012 at 17:09 - Reply

Very informative article. I’ve known about filter_var() for quite some time but I was unclear about a few of the flags.

Lately, I’ve rolled them all into two classes – one for sanitizing (user)data and one for validating (user)data. That saves me from needing to remember the syntax for all the ones I use a lot. Just call the appropriate class method and pass in the variable to be sanitized or validated.

Alexander Monday, April 23, 2012 at 10:55 - Reply

if i use: filter_var($email,FILTER_VALIDATE_EMAIL) then email like a – valid email

Leave a Reply

Your email address will not be published. Required fields are marked *

Inbound links