PHP Filters

What Is the Filter Extension?

In simple terms: PHP filters are ready-made tools for checking and cleaning data — "is this a valid integer?", "is this an email address?", "remove everything except digits". Instead of writing your own checks, you choose a filter and apply it to a value.

Technically: The filter extension (enabled by default) provides a set of filters identified by constants such as FILTER_VALIDATE_INT or FILTER_SANITIZE_EMAIL, and functions that apply them to single values (filter_var()), arrays of values (filter_var_array()), or request input directly (filter_input(), filter_input_array()). Each filter can be customized with options and flags.

Three Kinds of Filters

The form lessons showed how to use filters for validation (PHP Form Validation, PHP Form URL/E-mail) and sanitization (Form Input Sanitizing). This lesson explains the filter API itself; PHP Filters Advanced covers flags and options in detail.

The Filter Functions

Available Filters

<?php
$filters = filter_list();

var_dump(in_array('int', $filters, true));
var_dump(in_array('validate_email', $filters, true));
var_dump(filter_id('int') === FILTER_VALIDATE_INT);

Output

bool(true)
bool(true)
bool(true)

Each filter has a name (int, boolean, float, validate_email, email, url, …) and a constant. Code normally uses the constants; filter_list() and filter_id() are useful mainly for configuration-driven validation.

filter_var() and Its Options Structure

Syntax

filter_var(mixed $value, int $filter = FILTER_DEFAULT, array|int $options = 0): mixed

The third argument is either:

• a single flags integer: filter_var($v, FILTER_VALIDATE_BOOL, FILTER_NULL_ON_FAILURE), or
• an array with an 'options' key and/or a 'flags' key:

filter_var($value, FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 1, 'max_range' => 100, 'default' => 10],
    'flags' => FILTER_FLAG_ALLOW_HEX,
]);

The default Option

<?php
var_dump(filter_var('abc', FILTER_VALIDATE_INT, ['options' => ['default' => 1]]));
var_dump(filter_var('250', FILTER_VALIDATE_INT, ['options' => ['max_range' => 100, 'default' => 20]]));
var_dump(filter_var('42', FILTER_VALIDATE_INT, ['options' => ['default' => 1]]));

Output

int(1)
int(20)
int(42)

When validation fails, default is returned instead of false. This is convenient for optional parameters with a fallback, such as page numbers or page sizes.

FILTER_CALLBACK: Your Own Filter

<?php
$normalizeTag = fn(string $value): string => strtolower(preg_replace('/\s+/', '-', trim($value)));

var_dump(filter_var('  Web Development ', FILTER_CALLBACK, ['options' => $normalizeTag]));

print_r(filter_var(['PHP Basics', ' MySQL '], FILTER_CALLBACK, ['options' => $normalizeTag]));

Output

string(15) "web-development"
Array
(
    [0] => php-basics
    [1] => mysql
)

FILTER_CALLBACK calls any function (closure, function name, or first-class callable) on the value. When the value is an array, the callback is applied to each element recursively. This lets custom normalization be part of a filter definition together with built-in filters.

Filtering Arrays

Validation filters expect a scalar by default. Flags control how arrays are handled:

<?php
var_dump(filter_var(['5'], FILTER_VALIDATE_INT));
var_dump(filter_var(['1', '2', 'x'], FILTER_VALIDATE_INT, FILTER_REQUIRE_ARRAY));
var_dump(filter_var('5', FILTER_VALIDATE_INT, FILTER_FORCE_ARRAY));

Output

bool(false)
array(3) {
  [0]=>
  int(1)
  [1]=>
  int(2)
  [2]=>
  bool(false)
}
array(1) {
  [0]=>
  int(5)
}

This is exactly what is needed for inputs such as checkbox groups (ids[]): FILTER_REQUIRE_ARRAY both checks that an array was sent and validates each element.

Reading Request Data Directly: filter_input()

<?php
// Request: GET /products.php?page=3&debug

$page = filter_input(INPUT_GET, 'page', FILTER_VALIDATE_INT, ['options' => ['min_range' => 1]]);
$limit = filter_input(INPUT_GET, 'limit', FILTER_VALIDATE_INT);

var_dump($page, $limit);
var_dump(filter_has_var(INPUT_GET, 'debug'));

Output

int(3)
NULL
bool(true)

Things to Know About filter_input()

• It reads the original request data. Changes made to $_GET or $_POST in your code are not seen by it.
• In command-line scripts there is no request, so it always returns null — which makes code that uses it harder to test. Many applications therefore apply filter_var() or filter_var_array() to $_GET/$_POST, or to a request object, instead.

Practical Example: Reading Listing Parameters

A single definition can describe all query parameters of a page:

<?php
function readListingParams(array $query): array
{
    $query += ['page' => '1', 'per_page' => '20', 'sort' => 'newest', 'ids' => []];

    $definition = [
        'page' => [
            'filter' => FILTER_VALIDATE_INT,
            'options' => ['min_range' => 1, 'default' => 1],
        ],
        'per_page' => [
            'filter' => FILTER_VALIDATE_INT,
            'options' => ['min_range' => 1, 'max_range' => 100, 'default' => 20],
        ],
        'sort' => [
            'filter' => FILTER_VALIDATE_REGEXP,
            'options' => ['regexp' => '/^(newest|price|rating)$/', 'default' => 'newest'],
        ],
        'ids' => [
            'filter' => FILTER_VALIDATE_INT,
            'flags' => FILTER_REQUIRE_ARRAY,
        ],
    ];

    $params = filter_var_array($query, $definition);

    $params['ids'] = is_array($params['ids'])
        ? array_values(array_filter($params['ids'], 'is_int'))
        : [];

    return $params;
}

// Simulates: GET /products.php?page=3&per_page=500&sort=price&ids[]=4&ids[]=x&ids[]=9
echo json_encode(readListingParams([
    'page' => '3',
    'per_page' => '500',
    'sort' => 'price',
    'ids' => ['4', 'x', '9'],
])) . "\n";

echo json_encode(readListingParams([])) . "\n";

// In the real page: $params = readListingParams($_GET);

Output

{"page":3,"per_page":20,"sort":"price","ids":[4,9]}
{"page":1,"per_page":20,"sort":"newest","ids":[]}

Step-by-Step Explanation

1. $query += [...] fills in values for missing parameters. This is needed because filter_var_array() returns null for keys that are absent from the input; the default option only replaces values that are present but invalid.
2. Each parameter has a filter and options; together they describe valid input in one place.
3. page is a positive integer; per_page must be between 1 and 100, so 500 falls back to the default 20.
4. sort must match the allow-list pattern.
5. ids must be an array of integers; the invalid element x becomes false and is removed afterwards.

The function receives the query array as a parameter, so it is easy to test and to reuse.

Validation Filters at a Glance

Common Mistakes

Checking Results Loosely

Effect: Valid values 0, false, or '' are treated as failures.

Fix: Compare with === false (and === null for missing input with filter_input()).

Passing Options in the Wrong Structure

Effect: filter_var($v, FILTER_VALIDATE_INT, ['min_range' => 1]) silently ignores the range.

Fix: Nest options under 'options': ['options' => ['min_range' => 1]].

Expecting Scalar Filters to Accept Arrays

Effect: Array input fails (returns false).

Fix: Use FILTER_REQUIRE_ARRAY or FILTER_FORCE_ARRAY.

Expecting default to Fill Missing Keys in filter_var_array()

Effect: Missing parameters come back as null.

Fix: Merge default values into the input array first ($input += [...]).

Relying on filter_input() in Testable Code

Effect: Functions cannot be tested without real requests.

Fix: Apply filter_var()/filter_var_array() to arrays passed in as parameters.

Best Practices

• Use validation filters for standard formats and types, and convert values to their proper types in the same step.
• Describe all inputs of a form or page in one filter_var_array() definition with sensible defaults.
• Use FILTER_CALLBACK to integrate custom normalization.
• Handle arrays explicitly with FILTER_REQUIRE_ARRAY / FILTER_FORCE_ARRAY.
• Always compare results strictly.

Official reference: https://www.php.net/manual/en/book.filter.php