PHP5 Filter Functions Part 2

Following on from the previous post about the PHP filter functions there are two more filter functions that require some extra explanation. These functions are filter_var_array() and filter_input_array().

They work in much the same way as filter_var() and filter_input() but they accept an array as the input. This enables you to sanitize or validate many different variables at the same time.

The first step in using these functions is to create an argument array. This is an associative array of data identifiers that allow you to set filter and sanitizer flags for different values. For example, assume that the following array is going to be used.

$data = array(
 'rowid' => '10',
 'level' => '23',
 'text' => 'some <strong>text</strong>',
 'dataAray' => array('2', '23', '10', '12'),
);

To ensure that the rowid is always an integer the filter flag FILTER_VALIDATE_INT is used in the argument array like this.

$args = array('rowid' => FILTER_VALIDATE_INT);

The same thing needs to be done to the level value in the array. However, I also need to make sure that the value is between a certain range. This is done using an inner array containing the arguments filter (to validate the integer) and options (to define a minimum and maximum range).

$args = array(
 'rowid' => FILTER_VALIDATE_INT,
 'level' => array(
  'filter' => FILTER_VALIDATE_INT,
  'options' => array(
   'min_range' => 1,
   'max_range' => 30
  )
 )
);

Anything that isn't included in this argument array is not returned from the functions. So at the moment the functions would completely miss out the text and dataArray parts of the array. As the text variable has some HTML in it I want to use the FILTER_SANITIZE_SPECIAL_CHARS to turn this into character encoded text. The dataArray has to be all integers and I want to force this to be an array, even if it isn't. Even if the variable is an array the FILTER_VALIDATE_INT filter will

$args = array(
 'rowid' => FILTER_VALIDATE_INT,
 'level' => array(
  'filter' => FILTER_VALIDATE_INT,
  'options' => array(
   'min_range' => 1,
   'max_range' => 30
  )
 ),
 'text' => FILTER_SANITIZE_ENCODED,
 'dataAray' => array(
  'filter' => FILTER_VALIDATE_INT,
  'flags' => FILTER_FORCE_ARRAY,
 )
);

With the array in place we can now put it into the filter_var_array() and filter/sanitize the data.

$myinputs = filter_var_array($data, $args);
var_dump($myinputs);

This produces the following result.

array(4) {
 ["rowid"]=>
 int(10)
 ["text"]=>
 string(42) "some <strong>text</strong>"
 ["level"]=>
 int(23)
 ["dataAray"]=>
 array(4) {
  [0]=>
  int(2)
  [1]=>
  int(23)
  [2]=>
  int(10)
  [3]=>
  int(12)
 }
}

Using this with the filter_input_array() function is just the same, but in this case instead of the data as the first parameter we use one of INPUT_GET, INPUT_POST, INPUT_COOKIE, INPUT_SERVER, INPUT_ENV, INPUT_SESSION, or INPUT_REQUEST. The following example uses INPUT_POST to retrieve the data from a post request.

$myinputs = filter_input_array(INPUT_POST, $args);
var_dump($myinputs);

The callback filters can be used to change data from one form into another, basically creating your own sanitizers. Lets say that we had a HTML string, but that we only wanted to change three characters from their non-encoded forms to their encoded forms. These characters are <, > and ", which translate into &lt;, &gt; and &quot; respectively.

To run a callback function via a filter we use the FILTER_CALLBACK flag with an options array that points to the function we want to run.

function replaceTags($html){
 return str_replace(array('<', '>', '"'),array('&lt;', '&gt;', '&quot;'),$html);
}
 
$html = 'Some <strong style="padding:10px;">text</strong>';
 
echo filter_var($html,FILTER_CALLBACK,array('options'=>'replaceTags'));

When the filter_var() function is run in this bit of code it replaces the three characters in the HTML with their encoded equivalents.

Although there is plenty of information available on the php.net site there is a fantastic page at phpro.org that has examples on every filter and sanitizer used with the filtering functions.