What are PHP filters? What kinds of filters are there?

The previous article introduced you to "How to use PHP to write E-mail program files? 》, this article continues to introduce to you what is a PHP filter? What kinds of filters are there? Let’s go together!

#What are PHP filters?

• #PHP filters are used to validate and filter data from non-secure sources.

• Testing, validating, and filtering user input or custom data is an important part of any web application.
  

• # Filter extensions for PHP are designed to make data filtering easier and faster.
  

• #PHP filters are used to validate and filter data from non-secure sources, such as user input.

Why use filters?

Nearly all web applications rely on external input. This data usually comes from users or other applications (such as web services). By using filters, you can ensure that your application gets the correct input type.

You should always filter external data!

Input filtering is one of the most important application security topics.

What is external data?

Input data from forms

• Cookies
  

• Web services data
  

• Server variables
  

• Database query results

• Function and Filter

To filter a variable, use one of the following filter functions:

• filter_var() - Filter by a specified filter to filter a single variable
  

• filter_var_array() - filter multiple variables with the same or different filters
  

• filter_input - Gets an input variable and filters it
  

• filter_input_array - Gets multiple input variables and runs them through the same or different filters Filter
  

In the following example, we use the filter_var() function to verify an integer:

<?php
$int = 123;
if(!filter_var($int, FILTER_VALIDATE_INT))
{
echo("不是一个合法的整数");
}
else
{
echo("是个合法的整数");
}
?>

The result of running the code is as follows:

Validating and Sanitizing

There are two types of filters:

Validating filter:

• Used to validate user input
  

• Strict format rules (such as URL or E-Mail validation)
  

• Returns the expected type if successful or FALSE if failed
  

##Sanitizing filter:

• Used to allow or prohibit specified characters in a string

  
  

• No data format rules

  
  

• Always returns a string

  
  

• # Options and flags Options and flags are used to add additional filtering options to the specified filter.

• Different filters have different options and flags.

  
  

In the following example, we validate an integer using filter_var() with the "min_range" and "max_range" options:

<?php
$var=300;
$int_options = array(
"options"=>array
(
"min_range"=>0,
"max_range"=>256
)
);
if(!filter_var($var, FILTER_VALIDATE_INT, $int_options))
{
echo("不是一个合法的整数");
}
else
{
echo("是个合法的整数");
}
?>

Just like the code above, options must be put into a related array called "options". If using flags, they don't need to be in an array.

Since the integer is "300", which is not within the specified range, the output of the above code will be

The result of running the code is as follows:

Filter multiple inputs

Forms usually consist of multiple input fields. To avoid repeated calls to filter_var or filter_input functions, we can use filter_var_array or the filter_input_array function.

In this example, we use the filter_input_array() function to filter three GET variables. The received GET variables are a name, an age and an e-mail address:

<?php
$filters = array
(
"name" => array
(
"filter"=>FILTER_SANITIZE_STRING
),
"age" => array
(
"filter"=>FILTER_VALIDATE_INT,
"options"=>array
(
"min_range"=>1,
"max_range"=>120
)
),
"email"=> FILTER_VALIDATE_EMAIL
);
$result = filter_input_array(INPUT_GET, $filters);
if (!$result["age"])
{
echo("年龄必须在 1 到 120 之间。<br>");
}
elseif(!$result["email"])
{
echo("E-Mail 不合法<br>");
}
else
{
echo("输入正确");
}
?>

The result is as follows:

Explanation of examples:

The above example has three input variables (name, age and email) transmitted through the "GET" method:

Set an array that contains the name of the input variable and the filter for the specified input variable

Call the filter_input_array() function, the parameters include the GET input variable and the array just set

Check whether there are illegal inputs in the "age" and "email" variables in the $result variable. (If there is an illegal input, the input variable is FALSE after using the filter_input_array() function.)

The second argument to the filter_input_array() function can be an array or the ID of a single filter.

If this parameter is the ID of a single filter, then the specified filter will filter all values ​​in the input array.

If the parameter is an array, then the array must follow the following rules:

Must be an associative array in which the input variables are the keys of the array ( For example, "age" input variable)

The value of this array must be the ID of the filter, or an array specifying filters, flags and options

Recommended learning : "PHP Video Tutorial"

The above is the detailed content of What are PHP filters? What kinds of filters are there?. For more information, please follow other related articles on the PHP Chinese website!