PHP 8.4.0 RC2 available for testing

filter_var

(PHP 5 >= 5.2.0, PHP 7, PHP 8)

filter_varFiltra una variable con el filtro que se indique

Descripción

filter_var(mixed $variable, int $filter = FILTER_DEFAULT, mixed $options = ?): mixed

Parámetros

variable

Valor a filtrar

filter

El ID del filtro a aplicar. La página Tipos de filtros del manual enumera los filtros disponibles.

Si se omite, se utilizará FILTER_DEFAULT, que es equivalente a FILTER_UNSAFE_RAW. Esto resultará en que no se realice ningún tipo de filtro de forma predeterminada.

options

Array asociativo de opciones o disyunción lógica de flags. Si un filtro acepta opciones, se pueden indicar flags en el campo "flags" del array. Para el filtro "callback" debería pasarse el tipo callable. La llamada de la función de retorno (callback) debe aceptar un argumento, el valor a ser filtrado y debe retornar el valor tras su filtrado/saneamiento.

<?php
// Para filtros que acepten opciones, usar este formato
$opciones = array(
'options' => array(
'default' => 3, // valor a retornar si el filtro falla
// más opciones aquí
'min_range' => 0
),
'flags' => FILTER_FLAG_ALLOW_OCTAL,
);
$var = filter_var('0755', FILTER_VALIDATE_INT, $opciones);

// Para filtros que únicamente acepten flags, se pueden pasar directametne
$var = filter_var('oops', FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE);

// Para filtros que únicamente acepten flags, también pueden pasarse como
// array
$var = filter_var('oops', FILTER_VALIDATE_BOOLEAN,
array(
'flags' => FILTER_NULL_ON_FAILURE));

// Filtro "callback2
function foo($value)
{
// Formato esperado: Apellido, Nombre
if (strpos($value, ", ") === false) return false;
list(
$surname, $givennames) = explode(", ", $value, 2);
$empty = (empty($surname) || empty($givennames));
$notstrings = (!is_string($surname) || !is_string($givennames));
if (
$empty || $notstrings) {
return
false;
} else {
return
$value;
}
}
$var = filter_var('Doe, Jane Sue', FILTER_CALLBACK, array('options' => 'foo'));
?>

Valores devueltos

Retorna los datos filtrados o false si el filtro falla.

Ejemplos

Ejemplo #1 Un ejemplo de filter_var()

<?php
var_dump
(filter_var('bob@example.com', FILTER_VALIDATE_EMAIL));
var_dump(filter_var('http://example.com', FILTER_VALIDATE_URL, FILTER_FLAG_PATH_REQUIRED));
?>

El resultado del ejemplo sería:

string(15) "bob@example.com"
bool(false)

Ver también

add a note

User Contributed Notes 34 notes

up
173
cabrinosimone at gmail dot com
11 years ago
Pay attention that the function will not validate "not latin" domains.

if (filter_var('уникум@из.рф', FILTER_VALIDATE_EMAIL)) {
echo 'VALID';
} else {
echo 'NOT VALID';
}
up
6
Random Guy
9 months ago
Actually, this is not really a helpful comment for a manual (so, don't upvote), but as search engines don't find a lot of occurrences for the error message and especially no helpful hint, it might save somebody some time.

If you're getting an error message like "filter_var(): Unknown filter with ID 2097152" or a different number, you just accidentally mixed up the parameters. So, instead of

<?php
filter_var
($ip, FILTER_FLAG_IPV6)
?>

you should try it with

<?php
filter_var
($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)
?>

and it will work ;) I know, this isn't the most intuitive form you can design a function and it's tempting to throw everything into one param as it is done for regular checks, but, yeah, it is how it is.
up
101
gt at kani dot hu
11 years ago
I found some addresses that FILTER_VALIDATE_EMAIL rejects, but RFC5321 permits:
<?php
foreach (array(
'localpart.ending.with.dot.@example.com',
'(comment)localpart@example.com',
'"this is v@lid!"@example.com',
'"much.more unusual"@example.com',
'postbox@com',
'admin@mailserver1',
'"()<>[]:,;@\\"\\\\!#$%&\'*+-/=?^_`{}| ~.a"@example.org',
'" "@example.org',
) as
$address) {
echo
"<p>$address is <b>".(filter_var($address, FILTER_VALIDATE_EMAIL) ? '' : 'not')." valid</b></p>";
}
?>
Results:

localpart.ending.with.dot.@example.com is not valid
(comment)localpart@example.com is not valid
"this is v@lid!"@example.com is not valid
"much.more unusual"@example.com is not valid
postbox@com is not valid
admin@mailserver1 is not valid
"()<>[]:,;@\"\\!#$%&'*+-/=?^_`{}| ~.a"@example.org is not valid
" "@example.org is not valid

The documentation does not saying that FILTER_VALIDATE_EMAIL should pass the RFC5321, however you can meet with these examples (especially with the first one). So this is a note, not a bug report.
up
59
divinity76 at gmail dot com
7 years ago
note that FILTER_VALIDATE_BOOLEAN tries to be smart, recognizing words like Yes, No, Off, On, both string and native types of true and false, and is not case-sensitive when validating strings.

<?php
$vals
=array('on','On','ON','off','Off','OFF','yes','Yes','YES',
'no','No','NO',0,1,'0','1','true',
'True','TRUE','false','False','FALSE',true,false,'foo','bar');
foreach(
$vals as $val){
echo
var_export($val,true).': '; var_dump(filter_var($val,FILTER_VALIDATE_BOOLEAN,FILTER_NULL_ON_FAILURE));
}
?>

outputs:
'on': bool(true)
'On': bool(true)
'ON': bool(true)
'off': bool(false)
'Off': bool(false)
'OFF': bool(false)
'yes': bool(true)
'Yes': bool(true)
'YES': bool(true)
'no': bool(false)
'No': bool(false)
'NO': bool(false)
0: bool(false)
1: bool(true)
'0': bool(false)
'1': bool(true)
'true': bool(true)
'True': bool(true)
'TRUE': bool(true)
'false': bool(false)
'False': bool(false)
'FALSE': bool(false)
true: bool(true)
false: bool(false)
'foo': NULL
'bar': NULL
up
21
Steve
6 years ago
The note from "hek" about HTML5 having patterns thus alleviating the need to filter in PHP is completely wrong: You still must filter input on the server side. The HTML5 form inputs are client-side, meaning they are completely under the user's control. Only when you receive the data in PHP is it server-side and under your control. Once the data is under your control, then you must filter/sanitize it properly.

This is true regardless of server-side language. I would encourage the moderators to remove the note from "hek" because it will mislead people with horrible consequences.

Steve
up
58
Andi, info at pragmamx dot org
12 years ago
And this is also a valid url

http://example.com/"><script>alert(document.cookie)</script>
up
1
Anonymous
1 year ago
Pay attention:
questionmark in url is also valid

<?php
echo filter_var("http://test???test.com", FILTER_VALIDATE_URL)?"valid":"not valid"; #valid
?>
up
17
Anonymous
8 years ago
FILTER_VALIDATE_URL allows:

filter_var('javascript://comment%0Aalert(1)', FILTER_VALIDATE_URL);

Where the %0A (URL encoded newline), in certain contexts, will split the comment from the JS code.

This can result in an XSS vulnerability.
up
6
mpyw628 at gmail dot com
6 years ago
I wrote a JavaScript email validator fully compatible with PHP's filter_var() implementation.

mpyw/FILTER_VALIDATE_EMAIL.js: Email validation compatible with PHP's filter_var($value, FILTER_VALIDATE_EMAIL)
https://github.com/mpyw/FILTER_VALIDATE_EMAIL.js
up
1
Guy Sartorelli
1 year ago
Note that filter_var() with FILTER_VALIDATE_URL uses RFC2396 which is obsolete. This means it treats some currently valid characters (such as "_") as being invalid.

In many cases it may be more beneficial to use php parse_url() which uses RFC3986 which is what is currently in effect.
up
2
rschuetz at hmcw dot com
3 years ago
I cannot confirm what yactouat said. As of PHP 7.3, 0 will not be filtered out with FILTER_VALIDATE_INT. It correctly returns 0, not false. Of course you have to check the return value with an identity operator. Otherwise you cannot distinguish between 0 and false.
up
1
mmerlone at gmail dot com
3 years ago
Be aware that FILTER_FLAG_PATH_REQUIRED is happy with a single slash (/), so:

<?php
$options
= array('flags' => FILTER_FLAG_PATH_REQUIRED);
filter_var('http://example.com', FILTER_VALIDATE_URL, $options); // returns false
filter_var('http://example.com/', FILTER_VALIDATE_URL, $options); // returns 'http://example.com/'
?>
up
8
marcus at synchromedia dot co dot uk
12 years ago
It's very likely that you actually want to detect all reserved ranges, not just private IPs, and there's another constant for them that should be bitwise-OR'd with it.
<?php
function is_private_ip($ip) {
return !
filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);
}
?>
up
6
dale dot liszka at gmail dot com
16 years ago
Using the FILTER_CALLBACK requires an array to be passed as the options:

<?php
function toDash($x){
return
str_replace("_","-",$x);
}

echo
filter_var("asdf_123",FILTER_CALLBACK,array("options"=>"toDash"));
// returns 'asdf-123'
?>
up
7
dale dot liszka at gmail dot com
16 years ago
Here is how to use multiple flags (for those who learn better by example, like me):

<?php
echo "|asdf".chr(9).chr(128)."_123|";
echo
"\n";
// "bitwise conjunction" means logic OR / bitwise |
echo filter_var("|asdf".chr(9).chr(128)."_123\n|" ,FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH);

/*
Results:
|asdf �_123|
|asdf_123|
*/
?>
up
7
keevitaja at gmail dot com
12 years ago
please note FILTER_VALIDATE_URL passes following url

http://example.ee/sdsf"f
up
1
crisp at tweakers dot net
6 years ago
Note that only using FILTER_VALIDATE_URL to validate url's input may result in XSS:

$url = 'javascript://%0Aalert(document.cookie)';

if (filter_var($url, FILTER_VALIDATE_URL, FILTER_FLAG_SCHEME_REQUIRED)) {
echo '<a href="' . $url . '">click</a>';
}

You should at least additionally check the actually used scheme.
up
1
Robert Vlach
4 years ago
I won't recommend using this function to validate email addresses on a normal website. The problem is that in accordance with RFC 3696 (Application Techniques for Checking and Transformation of Names) the following email addresses would be considered as valid:

customer/department=shipping@example.com
$A12345@example.com
!def!xyz%abc@example.com
_somename@example.com
"Abc@def"@example.com

Hardly something I would accept in a live web app in 2020 :-/
up
3
jon dot bertsch at ucop dot edu
15 years ago
Here's an actual example of the filter syntax with a flag since there doesn't appear to be a one liner for this anywhere:

'hours' => array('filter'=>FILTER_SANITIZE_NUMBER_FLOAT, 'flags' => FILTER_FLAG_ALLOW_FRACTION, 'options'=> '.')
up
2
remindfwd
1 year ago
Please note that the following will return true, even if the URL is not correct. Because it validates only the domain, subdomain, path and query, not the protocol.

<?php

filter_var
( 'http://https://example.com', FILTER_VALIDATE_URL );
?>

Please read more on https://www.php.net/manual/en/filter.filters.validate.php
up
1
ajcorrea at gmail dot com
1 year ago
You can use multiple FLAGS to validate an ip address:

//Validade if input is an IPv4 Address:
$_FILTERS = array('flags' => FILTER_FLAG_IPV4);

//Validade if input is an IPv4 address and isn´t a private IP.
$_FILTERS = array('flags' => FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE);

//Validade if input is an IPv4 and isn´t a reserved IP.
$_FILTERS = array('flags' => FILTER_FLAG_IPV4 | FILTER_FLAG_NO_RES_RANGE);

//Validade if input is an IPv4, isn´t a private IP and isn´t a reserved IP.
$_FILTERS = array('flags' => FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);

filter_var($_input, FILTER_VALIDATE_IP, $_FILTERS);
up
0
axew3 at me dot you
2 months ago
I've see some report about FILTER_VALIDATE_URL and i also would like to add mine, because into a stupid code like this:
<?php
$ckOrigin
= 'https://forum.myw3host.comhttps://forum.myw3host.comhttps://forum.myw3host.com/viewtopic.php?p=45#p45';

if(
filter_var($ckOrigin, FILTER_VALIDATE_URL)){
echo
'ok the URL is valid';
}
?>

since i was sure that in case the url were wrong it had returned false, I spent a lot of time to realize that it instead fail into a string like the one above, and it return true.
up
-1
dakaenev at gmail dot com
9 months ago
As reply of https://www.php.net/manual/en/function.filter-var.php#128235

if you use FILTER_FLAG_PATH_REQUIRED it work correct.

var_dump( filter_var('http://test???test.com/path/?t=1', FILTER_VALIDATE_URL) ); // true

var_dump( filter_var('http://test???test.com/path/?t=1', FILTER_VALIDATE_URL, FILTER_FLAG_PATH_REQUIRED) ); // false
up
0
yactouat at hotmail dot com
5 years ago
While getting familiar with filter_var( $var, FILTER_VALIDATE_INT ), I found interesting that 0 will be filtered out and therefore wont be considered as an int. Hope that helps someone not to be stuck ;)

N.B.: if you need to accept 0's, you could use is_int()
up
0
Ant
8 years ago
Note: filter_var with filter=FILTER_VALIDATE_URL used parse_url function
up
0
joe at bloe dot com
10 years ago
"(comment)localpart@example.com"
is an invalid E-Mail address per RFC5322 (Appendix A.6.3):
"Also, the comments and white space throughout addresses, dates, and message identifiers are all part of the obsolete syntax."
up
0
dyer85 at gmail dot com
15 years ago
Note that when using FILTER_VALIDATE_INT along with the FILTER_FLAG_ALLOW_HEX flag, the string "2f", for example, is not validated successfully, because you must use the "0x" prefix, otherwise, it treats the data as base 10.

The range options are also smart enough to recognize when the boundaries are exceeded in different bases.

Here's an example:

<?php

$foo
= '256';
$bar = '0x100';
var_dump(validate_int($foo)); // false, too large
var_dump(validate_int($bar)); // false, too large

function validate_int($input)
{
return
filter_var(
$input,
FILTER_VALIDATE_INT,

// We must pass an associative array
// to include the range check options.
array(
'flags' => FILTER_FLAG_ALLOW_HEX,
'options' => array('min_range' => 1, 'max_range' => 0xff)
)
);
}

?>
up
-1
php at maisqi dot com
13 years ago
FILTER_VALIDATE_URL does not support internationalized domain name (IDN). Valid or not, no domain name with Unicode chars on it will pass validation.

We can circumvent this with a home grown solutions, but C code is C code, so I've gone for the code bellow, which builds on filter_var().

<?php
$res
= filter_var ($uri, FILTER_VALIDATE_URL);
if (
$res) return $res;
// Check if it has unicode chars.
$l = mb_strlen ($uri);
if (
$l !== strlen ($uri)) {
// Replace wide chars by “X”.
$s = str_repeat (' ', $l);
for (
$i = 0; $i < $l; ++$i) {
$ch = mb_substr ($uri, $i, 1);
$s [$i] = strlen ($ch) > 1 ? 'X' : $ch;
}
// Re-check now.
$res = filter_var ($s, FILTER_VALIDATE_URL);
if (
$res) { $uri = $res; return 1; }
}
?>

The logic is simple. A non-ascii char is more than one byte long. We replace every one of those chars by "X" and check again.

An alternative will be to punycode the URI before calling filter_var(), but PHP lacks native support for punycode. I think my approach is effective. Please e-mail me if you think otherwise or see room for improvement.
up
-1
dan at spiral8 dot net
8 years ago
Here's a simple test using filter_var with FILTER_VALIDATE_URL.
(If you're using file_get_contents after this you will run into a problem, I was using: PHP 5.5.12 (cli))

<?php
$url
= 'a://google.com';

$result = filter_var($url, FILTER_VALIDATE_URL);

if(
$result){
echo
'Valid URL'.PHP_EOL;
}

var_dump($result);
?>

The result is:
Valid URL
string(14) "a://google.com"
up
-4
drew_mirage at hotmail dot com
11 years ago
One key thing to remember about filtering integers is that the value for the option max_range must be less than or equal to the value of PHP_INT_MAX.

filter_var($someVariable, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => SOME_VALUE_GREATER_THAN_PHP_INT_MAX)));

This will fail even if $someVariable is a valid integer in the expected range.

This can show up when you are attempting to validate a potential key for an unsigned MySQL INT type (whose maximum value is 4294967295) on a 32-bit system, where the value of PHP_INT_MAX is 2147483647.
up
-4
buttflattery at gmail dot com
8 years ago
FILTER_VALIDATE_URL validates a url like http://www.
up
-5
yoanlin93 at gmail dot com
8 years ago
Some boolean conversions:

<?php
var_dump
(filter_var('oops', FILTER_VALIDATE_BOOLEAN, array('flags' => FILTER_NULL_ON_FAILURE)));
// NULL

var_dump(filter_var('false', FILTER_VALIDATE_BOOLEAN, array('flags' => FILTER_NULL_ON_FAILURE)));
// bool(false)

var_dump(filter_var('true', FILTER_VALIDATE_BOOLEAN, array('flags' => FILTER_NULL_ON_FAILURE)));
// bool(true)

var_dump(filter_var(0, FILTER_VALIDATE_BOOLEAN, array('flags' => FILTER_NULL_ON_FAILURE)));
// bool(false)

var_dump(filter_var(1, FILTER_VALIDATE_BOOLEAN, array('flags' => FILTER_NULL_ON_FAILURE)));
// bool(true)

var_dump(filter_var('TRUE', FILTER_VALIDATE_BOOLEAN, array('flags' => FILTER_NULL_ON_FAILURE)));
// bool(true)

var_dump(filter_var('', FILTER_VALIDATE_BOOLEAN, array('flags' => FILTER_NULL_ON_FAILURE)));
// bool(false)

var_dump(filter_var('FALSE', FILTER_VALIDATE_BOOLEAN, array('flags' => FILTER_NULL_ON_FAILURE)));
// bool(false)
up
-4
Tom
10 years ago
It is important to note that though the data type of the first parameter of the function is stated as "mixed", this is only one half of the truth.

While it accepts any data type, the first parameter will always be cast to string before being validated or sanitized.

It seems that this function was designed strictly to be used on user input strings. For example: from an online-form. When using it for anything other than that, you may see issues. So read the documentation very carefully!

Especially note that there is an (to date) unresolved issue (#49510) concerning the Boolean filter while using the FILTER_NULL_ON_FAILURE flag. Note that both (string) FALSE and FALSE are not recognized as boolean values and will return NULL (not FALSE as you might expect).

I thus personally suggest that (to date) the best way to take the filter_var()-functions beyond their original purpose (and allow future extension and customization) is to wrap them in your own classes. This will allow you to work-around unexpected behavior on non-string input and add your custom checks, or back-port filters or sanitizers that may be added in later versions of PHP.
(Especially since PHP currently still lacks filters and sanitizers for some of the more exotic HTML5 input types, like "color". Thus there actually is a chance that we may see a need for custom filters or backports at some point in the future.)
up
-3
Anonymous
6 years ago
Replying to Andi:

This is NOT a valid URL, as the characters are not encoded

http://example.com/"><script>alert(document.cookie)</script>

This is a valid URL:

http://example.com/%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E
To Top