Input validation using the filter function in PHP

if (Isset ($_get["value"])) { $value = $_get["value"]; } else { $value = false; } if (Is_numeric ($value) && ($value >= && $value <= 20)) { Run My Code } else { Handle the issue } Copy Code This is a very basic example, we have written more lines, I want to see?? Of First, because we are not sure about setting the $ _get, the code performs an appropriate check so that the script does not tip over. The second is the fact that the dollar value is now a "dirty" variable because it has been directly from the specified $ _get value. We need to take care not to use the value of the dollar in the case of other places in the code, we break anything. Then there is the problem that the 16.0 is_numeric () function is effective because of the various modal words it has. Finally, we have to issue with the fact that if the statement is taken a bit, it is an extra logical bit to work through when you track through the code. Now compare the above example: $value = Filter_input (Input_get, "value", Filter_validate_int, Array ("options" = = Array ("Min_range" and "max_range" = 20))); if ($value) { Run My Code } else { Handle the issue } Copy Code Doesn't make you feel warm and fuzzy? Filter_input () handles the $ _get value is not set, so you don't have to stress whether the script receives the correct information, or not. You also don't have to worry about the dollar value being dirty, because it has been confirmed before it has been assigned. Note that the current 16.0 is no longer valid. Finally, our logic is no longer complex. This is just a quick check for the Truthy value (Filter_input () If the validation fails, it will return false and null if the $ _GET ["value") is not set. Obviously, in a real world setting, you can extract the array of variables stored in the config file into a place so that you can get something that doesn't even have to go into the business logic change. Gorgeous! Now, you might think that it might be useful to grab a couple of simple scripts for $ _GET or $ _post variables, but internally used functions or classes about? Fortunately, we have the Filter_var (). The Filter_var () function is introduced and does the same thing as Filter_input (). This is an example function that does not use this actually e-mail, That would be foolish. function Emailuser ($email) { Mail ($email, "Here is my email", "Some Content"); } Copy Code The danger here is that there is no attempt to send an email, literally any value that can be stored in the Stop message () function $ e-mail. This can lead to the inability to send email, or something more and more likely to use the malicious features in the worst case scenario. What I see people do?? The result of the check's mail (), which is pretty good if the function completes successfully, but the damage is the time value returned. Something like this is more sensible: This is a sample function, does not use the to actually email, That's would be silly. function Emailuser ($email) { $email = Filter_var ($email, Filter_validate_email); if ($email!== false) { Mail ($email, "Here is my email", "Some Content"); } else { Handle the issue invalid email address } } Copy Code Many examples have been used, including the above problem is that they are basic. You may think that you cannot use any Filter_var () or filter_input () other than the basic check. and allows you to pass in a filter to these functions called Filter_callback. Filter_callback allows you to enter functionality through the variables you create that will accept the filter-which is where you can start, because there is a lot of fun you can start your own business logic to apply to your filters. Some potential flaws these features are very great and they let you do some really powerful filtering that we've discussed that can help improve the security and reliability of your code. But there are some potential drawbacks, I would think I was remiss if I did not point out. The main flaw is that as long as your filter applies to its function is. The last example, using email authentication-How to handle email address changes between 5.2.14 and 5.3.3 Filter_validate_email, even assuming that all applications running the same version of PHP have e-mail addresses that are technically valid, you may not want. Make sure that you know the filter you are using. The second pitfall is that people think that if they are in some filters, then put their code is safe. Filter the variables to go some help, but it will not make your code 100% safe from abuse. I would like to talk about this problem, but beyond the scope of this article and my word count is already quite high! Summary: I want you to have a function in your code, only one, to see what happens when you pass in different data types and different values. Then I want you to apply some of the filtering methods discussed here to see if there is a difference in how your code performs. I'd like to know how you are commenting.

