filter_input

(PHP 5 >= 5.2.0)

filter_inputToma una variable externa concreta por nombre y opcionalmente la filtra

Descripción

mixed filter_input ( int $type , string $variable_name [, int $filter = FILTER_DEFAULT [, mixed $options ]] )

Parámetros

type

Uno de los siguientes: INPUT_GET, INPUT_POST, INPUT_COOKIE, INPUT_SERVER o INPUT_ENV.

variable_name

Nombre de la variable a escoger.

filter

ID del filtro a usar. La página del manual Tipos de filtros lista los filtros disponibles.

options

Array asociativo de opciones o disyunción lógica de flags. Si el filtro acepta opciones, se pueden añadir flags en el array asociativo bajo la clave "flags".

Valores devueltos

En caso de éxito, valor de la variable pedida, FALSE si el filtro falla o NULL si la variable variable_name no está definida. Si se usa el flag FILTER_NULL_ON_FAILURE, retorna FALSE si la variable no está definida y NULL si el filtro falla.

Ejemplos

Ejemplo #1 Un ejemplo de filter_input()

<?php
$buscar_html 
filter_input(INPUT_GET'buscar'FILTER_SANITIZE_SPECIAL_CHARS);
$buscar_url filter_input(INPUT_GET'buscar'FILTER_SANITIZE_ENCODED);
echo 
"Has buscado $buscar_html.\n";
echo 
"<a href='?buscar=$buscar_url'>Buscar de nuevo</a>";
?>

El resultado del ejemplo sería algo similar a:

Has buscado Yo & hijo.
<a href='?search=Yo%20%26%20hijo'>Buscar de nuevo</a>

Ver también

add a note add a note

User Contributed Notes 13 notes

up
15
ss23 at ss23 dot geek dot nz
4 years ago
Note that this function doesn't (or at least doesn't seem to) actually filter based on the current values of $_GET etc. Instead, it seems to filter based off the original values.
<?php
$_GET
['search'] = 'foo'; // This has no effect on the filter_input

$search_html = filter_input(INPUT_GET, 'search', FILTER_SANITIZE_SPECIAL_CHARS);
$search_url = filter_input(INPUT_GET, 'search', FILTER_SANITIZE_ENCODED);
echo
"You have searched for $search_html.\n";
echo
"<a href='?search=$search_url'>Search again.</a>";
?>

If you need to set a default input value and filter that, use filter_var on your required input variable instead
up
14
anthony dot parsons at manx dot net
7 years ago
FastCGI seems to cause strange side-effects with unexpected null values when using INPUT_SERVER and INPUT_ENV with this function. You can use this code to see if it affects your server:
<?php
var_dump
($_SERVER);
foreach (
array_keys($_SERVER) as $b ) {
   
var_dump($b, filter_input(INPUT_SERVER, $b));
}
echo
'<hr>';
var_dump($_ENV);
foreach (
array_keys($_ENV) as $b ) {
   
var_dump($b, filter_input(INPUT_ENV, $b));
}
?>
If you want to be on the safe side, using the superglobal $_SERVER and $_ENV variables will always work. You can still use the filter_* functions for Get/Post/Cookie without a problem, which is the important part!
up
7
CertaiN
6 months ago
This function provides us the extremely simple solution for type filtering.

Without this function...
<?php
if (!isset($_GET['a'])) {
   
$a = null;
} elseif (!
is_string($_GET['a'])) {
   
$a = false;
} else {
   
$a = $_GET['a'];
}
$b = isset($_GET['b']) && is_string($_GET['b']) ? $_GET['b'] : '';
?>

With this function...
<?php
$a
= filter_input(INPUT_GET, 'a');
$b = (string)filter_input(INPUT_GET, 'b');
?>

Yes, FILTER_REQUIRE_SCALAR seems to be set as a default option.
It's very helpful for eliminating E_NOTICE, E_WARNING and E_ERROR.
This fact should be documented.
up
5
akshay dot leadindia at gmail dot com
1 year ago
The beauty of using this instead of directly using filter_var( $_GET['search'] ) is that you don't need to check if( isset( $_GET['search'] ) ) as if you pass that to filter_var and the key is not set then it will result in a warning. This function simplifies this and will return the relevant result to you (as per your options set) if the key has not been set in the user input.

If the type of filter you are using also supports a 'default' argument then this function will also stuff your missing input key with that value, again saving your efforts
up
5
chris at chlab dot ch
2 years ago
To use a class method for a callback function, as usual, provide an array with an instance of the class and the method name.
Example:

<?php
class myValidator
{
  public function
username($value)
  {
   
// return username or boolean false
 
}
}

$myValidator = new myValidator;
$options = array('options' => array($myValidator, 'username'));
$username = filter_input(INPUT_GET, 'username', FILTER_CALLBACK, $options);
var_dump($username);
?>
up
8
travismowens at gmail dot com
4 years ago
I wouldn't recommend people use this function to store their data in a database.  It's best not to encode data when storing it, it's better to store it raw and convert in upon the time of need.

One main reason for this is because if you have a short CHAR(16) field and the text contains encoded characters (quotes, ampersand) you can easily take a 12 character entry which obviously fits, but because of encoding it no longer fits.

Also, while not as common, if you need to use this data in another place, such as a non webpage (perhaps in a desktop app, or to a cell phone SMS or to a pager) the HTML encoded data will appear raw, and now you have to decode the data.

In summary, the best way to architect your system, is to store data as raw, and encode it only the moment you need to.  So this means in your PHP upon doing a SQL query, instead of merely doing an   echo $row['title']  you need to run htmlentities() on your echos, or better yet, an abstract function.
up
3
west {:a7} jsausa {:d0t}~ com
2 years ago
It's worth noting that the names for variables in filter input obey the same rules as variable naming in PHP (must start with an underscore or letter).  We were allowing users to build custom forms but hashing the names to prevent them from putting arbitrary content into the dom.  Turns out the hash function occasionally produced entirely numeric values for the field name... which doesn't work with filter_input but worked fine if you read directly from $_GET, $_POST, or $_REQUEST.  A workaround is to always prefix an underscore to the field name.
up
1
Maksym Karazeev
5 years ago
Just a tip.

Note how to setup default filter for filter_var_array

When I tried to use filter_var_array and didn't mentioned all array indexes in definition it filtered it with some filter and broke values so using this tip corrected everything

<?php
$def
= array_map(create_function('', 'return array("filter"=>FILTER_UNSAFE_RAW);'), $input);
?>
up
0
rimelek at rimelek dot hu
1 month ago
If your $_POST contains an array value:
<?php
$_POST 
= array(
   
'var' => array('more', 'than', 'one', 'values')
);
?>
you should use FILTER_REQUIRE_ARRAY option:
<?php
var_dump
(filter_input(INPUT_POST, 'var', FILTER_DEFAULT , FILTER_REQUIRE_ARRAY));
?>
Otherwise it returns false.
up
0
viaujoc at videotron dot ca
1 month ago
filter_input() does not seem to support multiple values for a single variable name.

Here is the code comparing the behavior of bare $_GET superglobal vs filter_input(INPUT_GET,...):
<?php
print("Bare \$_GET:\n");
var_dump($_GET);
print(
"filter_input():\n");
var_dump(filter_input(INPUT_GET,"var"));
?>

When calling: /..../script.php?var=123 (there is only one value for variable 'var')
Output is:
Bare $_GET:
array(1) {
  ["var"]=>
  string(3) "123"
}
filter_input():
string(3) "123"

When calling: /..../script.php?var[]=123&var[]=999 (there are two  values for variable 'var')
Output is:
Bare $_GET:
array(1) {
  ["var"]=>
  array(2) {
    [0]=>
    string(3) "123"
    [1]=>
    string(3) "999"
  }
}
filter_input():
bool(false)

As expected, $_GET['var'] became an array. But filter_input() seems to be unable to process multiple values and returns false.
up
0
Stefan Weinzierl
9 months ago
Here is an example how to work with the options-parameter. Notice the 'options' in the 'options'-Parameter!

<?php
$options
=array('options'=>array('default'=>5, 'min_range'=>0, 'max_range'=>9));

$priority=filter_input(INPUT_GET, 'priority', FILTER_VALIDATE_INT, $options);
?>

$priority will be 5 if the priority-Parameter isn't set or out the given range.
up
-1
descartavel1+php at gmail dot com
7 months ago
contrary to what is stated here on the comments on thow to use the options for filters, there is no range option or default... in fact, there is not much option AT ALL. It is not mentioned in the manual anywhere, and the provided code on that comment does nothing with php-5.4.4..

<?php
get
(GET, 'p', FILTER_VALIDATE_INT, array('options'=>array('default'=>5, 'min_range'=>0, 'max_range'=>9)) );
// ?p=30 => 30
// ?p="123" => 123
// ?p=-23 => -23
// ?p=asdf => null
?>
up
-15
med dot k1987 at yahoo dot com
4 years ago
Hello,
Does anybody know how to prevent FILTER_SANITIZE_SPECIAL_CHARS from converting the line breaks (\n) into (&#10;).
I'm developing a simple commenting system for my website and I found that the php filter converts \n to &#10; so when using nl2br() there are no line breaks.
help please.
thanks :)
To Top