Input validation using filter function in php

 if (isset($_GET["value"])) {
 $value = $_GET["value"];
 }
 else {
 $value = false;
 }
 if (is_numeric($value) && ($value >= 15 && $value <= 20)) {
 // run my code
 }
 else {
 // handle the issue
 }

This is a very basic example, we have written more lines that I would like to see. First, since we can't determine what $_GET is set to, the code performs the appropriate checks so that the script doesn't tip over. Second is the fact that the USD value is now a "dirty" variable because it has been specified directly from the $_GET value. We need to take care not to use the dollar value elsewhere in the code in case we break anything. Then there is the problem that the 16.0 is_numeric() function is valid because of various modal particles. Finally, we have to deal with the fact that if the statement is taken out of a mouth, there is an extra bit of logic passed through when you work through code tracing. Now compare the above example:

$value = filter_input(INPUT_GET, "value", FILTER_VALIDATE_INT,
 array("options" => array("min_range" => 15, "max_range" => 20 )));
if ($value) {
 // run my code
}
else {
 // handle the issue
}

doesn’t make you feel warm and fuzzy? The $_GET value handled by filter_input() is not set, so you don't have to stress whether the script is receiving the correct information, or not. You also don't have to worry about the dollar value being dirty because it has been verified before it has been assigned. Note that the current version 16.0 is no longer valid. Finally, our logic is no longer complicated. This is just a quick check for truthy values ​​(filter_input() will return false if validation fails and null if $_GET["value"] is not set. Obviously, in a real world setting, you could extract the array of variables stored in the configuration file somewhere so that you could get something to change without even having to get into the business logic. gorgeous! Now, you might be thinking that it might be useful to grab a couple of $_GET or $_POST variables in a simple script, but what about using a function or class internally? Fortunately, we have filter_var(). The filter_var() function was introduced to do the same thing as filter_input().

 //This is an example function, it would be stupid not to use this to actually email,
//
 function emailUser($email) {
 mail($email, "Here is my email", "Some Content");
 }

The danger here is, is there any When trying to send an email, literally any value can be stored in the stopmail() function $email. This could result in an email being unable to be sent, or something getting malicious functionality that could, in the worst case scenario, be used. What I've seen people do is check the result of mail() , which is nice to see if the function completes successfully, but what harms it is the time value returned. Something like this is much more sane:

 // This is a sample function, do not use this to actually email,
 // that would be silly.
 function emailUser($email) {
 $email = filter_var($ email, FILTER_VALIDATE_EMAIL);
 if ($email !== false) {
 mail($email, "Here is my email", "Some Content");
 }
 else {
 // handle the issue invalid email address
 }
 }

A lot of examples are used, including the above questions, they are basic. You might be thinking that filter_var() or filter_input() cannot be used for anything other than basic checking. And allows you to pass in a filter to these functions called FILTER_CALLBACK. FILTER_CALLBACK allows you to pass in the variables you create that will accept the variables being filtered - this is where you can start, because to have a lot of fun, you can start applying your own business logic to your filtering. some potential pitfalls These features are really great and they let you do some really powerful filtering that we've discussed that can help improve the security and reliability of your code. But there are some potential drawbacks, and I'd feel remiss if I didn't point them out. The main flaw is that as long as your filter is applied to its function. One final example, using email validation - how to handle email addresses changing between 5.2.14 and 5.3.3 FILTER_VALIDATE_EMAIL, even assuming all applications running the same version of PHP have email addresses that are technically valid, You probably don't want to. Make sure you know which filter you are using. The second pitfall is that people think that if they put in some filters then their code is safe. Filtered variables go some help, but it won't make your code 100% safe from abuse. I'd love to talk about this, but it's beyond the scope of this article and my word count is already quite high! Summarize: I think you make one function and only one in your code and see what happens when you pass in different data types and different values. Then, I'd like you to apply some of the filtering methods discussed here and see if there are differences in how your code performs. I'd love to know what you think about your comments.