PHP Filters

Introduction

Any time your PHP script accepts data from outside — a form field, a URL parameter, an uploaded file name — that data cannot be trusted. It might be malformed, missing, or deliberately malicious. PHP's filter extension gives you a consistent, built-in way to check and clean that data before you use it.

In this lesson you will learn the filter_var() function, the difference between validating data and sanitizing it, and how to apply both to a small real-world form.

Why Filter Data?

A classic rule in web development is: never trust user input. A visitor can type anything into a form field, tamper with a URL, or send a request that bypasses your HTML entirely. Without checking that data, your application can crash, store garbage, or become vulnerable to attacks like SQL injection or cross-site scripting.

PHP's filter functions were built specifically to make checking and cleaning external data quick and consistent, instead of writing ad-hoc regular expressions and if-statements every time.

The filter_var() Function

filter_var() takes a value and a filter, and returns either the filtered result or false if the value fails validation. Its basic signature is filter_var($variable, $filter, $options).

<?php
$email = "jane@example.com";

$result = filter_var($email, FILTER_VALIDATE_EMAIL);

if ($result !== false) {
    echo "Valid email: $result";
} else {
    echo "Invalid email address.";
}

Valid email: jane@example.com

If the email were malformed — missing an @ symbol, for example — filter_var() would return the boolean false instead of a string, which is why you should always compare with !== false rather than a loose truthy check (an empty string or "0" could otherwise be misread as failure).

Validating vs Sanitizing

These two words are used constantly in PHP's documentation, and it is worth being precise about what each means.

A good rule of thumb: validate data you expect to be strictly correct (like an email or an age), and sanitize data that is free-form text a user might type carelessly (like a comment or a search box).

Common Validation Filters

These filters check the shape of the data and return false when it does not match.

<?php
var_dump(filter_var("42", FILTER_VALIDATE_INT));
var_dump(filter_var("not-a-number", FILTER_VALIDATE_INT));
var_dump(filter_var("https://example.com", FILTER_VALIDATE_URL));
var_dump(filter_var("javascript:alert(1)", FILTER_VALIDATE_URL));

// Restrict an integer to a specific range
$age = filter_var("15", FILTER_VALIDATE_INT, [
    "options" => ["min_range" => 18, "max_range" => 120],
]);
var_dump($age); // false, because 15 is below min_range

int(42)
bool(false)
string(19) "https://example.com"
bool(false)
bool(false)

Common Sanitization Filters

Sanitization filters clean a string by removing or encoding characters, rather than rejecting it outright.

<?php
$comment = "<b>Nice post!</b> 5 stars";

$safe = filter_var($comment, FILTER_SANITIZE_SPECIAL_CHARS);
echo $safe;

<b>Nice post!</b> 5 stars

Example: Validating a Form

Imagine a small signup form that submits an email address and an age. Before doing anything else with this data — like saving it to a database — you should validate both fields and collect any errors.

<?php
// Pretend this came from $_POST in a real form submission
$input = [
    "email" => "  jane@example.com",
    "age"   => "27",
];

$errors = [];

// Sanitize first (trim stray whitespace from copy/paste), then validate
$email = filter_var(trim($input["email"]), FILTER_SANITIZE_EMAIL);
if (filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
    $errors[] = "Please enter a valid email address.";
}

$age = filter_var($input["age"], FILTER_VALIDATE_INT, [
    "options" => ["min_range" => 13, "max_range" => 120],
]);
if ($age === false) {
    $errors[] = "Age must be a whole number between 13 and 120.";
}

if (empty($errors)) {
    echo "Form is valid! Email: $email, Age: $age";
} else {
    echo "Please fix the following:\n";
    foreach ($errors as $error) {
        echo "- $error\n";
    }
}

Form is valid! Email: jane@example.com, Age: 27

If the visitor had typed "not-an-email" and "9" instead, the same script would print both error messages, letting you re-show the form with helpful feedback rather than crashing or silently accepting bad data.

Common Mistakes

Best Practices

Frequently Asked Questions

Key Takeaways

Summary

PHP's filter extension gives you a reliable, built-in toolkit for handling untrusted input without hand-rolling checks yourself. filter_var() is the workhorse function, and knowing when to validate versus when to sanitize is the key skill this lesson covered.

Next, you will build on this by learning regular expressions, which give you much finer control over matching and manipulating text patterns than the built-in filters alone.