PHP5 Filter Functions

Geoffrey Dunn

Mister Pink

Filter Functions

• What are they?
• Why they are needed?
• Basics on using them
• Why they are long overdue

What are they?

• PHP 5 has a new module called Filter Functions
• Although marked experiemental I encourage all PHP developers to look it over
• They allow you to quickly check input data (from any source) is set and valid before use
• Most of us have had to do this already. The filter functions will allow us to do it better and faster

Why they are needed?

• Currently you need to do a lot of coding to validate your data
• isset() and intval() works great for simple data. But what about emails, urls and other complex information that can be dangerous if not checked
• Much of this custom code will cause perfectly valid data to be marked as invalid such as o'brien@example.com as an email address

Basics on using them

• Install by running

  pecl install -f filter

  as super user
• Follow the instructions given to add the extension to your php.ini
• You only need to know one function to do all the work: input_get_args()

• input_get_args(INPUT_GET, array('pageId' => FILTER_VALIDATE_INT));

• input_get_args(INPUT_POST, array(
  	'name' => array('filter' => FILTER_UNSAFE_RAW, 'flags' => FILTER_FLAG_STRIP_LOW)),
  	'homepage' => array(
  'filter' => FILTER_VALIDATE_URL,
  'flags' => FILTER_FLAG_SCHEME_REQUIRED | FILTER_FLAG_HOST_REQUIRED)),
  	'email' => FILTER_VALIDATE_EMAIL)
  	);

Why they are long overdue

• Filtering input data is important to stopping hacking attempts
• Some of the filtering conditions can be run faster in the C library
• It allows a lot of complex checking in far less code

An Example

• filter.php
• Results