PHP Filters: Robust Input Validation & Data Sanitization

One of the most important rules in web security is: "Never trust user input." Malicious or poorly formatted user inputs can break database queries, cause server crashes, or trigger Cross-Site Scripting (XSS) vulnerabilities. PHP provides a powerful built-in Filter Extension centered around the filter_var() and filter_input() functions designed specifically to validate and sanitize external data.

Validation vs Sanitization: Understanding the Distinction

• Sanitize Filters: Modify the input by stripping or encoding dangerous characters (e.g. removing HTML tags). Returns the cleansed string.
• Validate Filters: Strictly test whether the input matches a valid specification (e.g. valid IP address, valid URL, valid integer). Returns the value on success or false on failure.

1. Validating and Sanitizing Email Addresses

<?php
    $emailInput = "  vikram.aditya+test@veewom.com  ";

    // Step 1: Sanitize by removing illegal characters & trimming
    $cleanEmail = filter_var(trim($emailInput), FILTER_SANITIZE_EMAIL);

    // Step 2: Validate against RFC email standards
    if (filter_var($cleanEmail, FILTER_VALIDATE_EMAIL)) {
        echo "Valid Email: " . $cleanEmail . "<br>";
    } else {
        echo "Invalid Email Address provided!<br>";
    }
?>

2. Validating Integers within a Range (e.g. Student Age)

<?php
    $studentAge = "21"; // String from form submission

    // Validate integer between 18 and 30
    $options = [
        "options" => [
            "min_range" => 18,
            "max_range" => 30
        ]
    ];

    if (filter_var($studentAge, FILTER_VALIDATE_INT, $options) !== false) {
        echo "Valid candidate age: $studentAge years.<br>";
    } else {
        echo "Eligibility Error: Candidate must be between 18 and 30 years.<br>";
    }
?>

3. Validating URLs and IP Addresses (IPv4 & IPv6)

<?php
    $website = "https://veewom.com";
    if (filter_var($website, FILTER_VALIDATE_URL)) {
        echo "Valid Web Address.<br>";
    }

    $clientIP = "192.168.1.1";
    if (filter_var($clientIP, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
        echo "Valid IPv4 Network Address.";
    }
?>

Essential PHP Filters Reference Table

BCA / CS University Exam Corner

Interactive Student Practice Session