filter_var_array

To apply the same filter to many params/keys, use array_fill_keys().

<?php
$data = array(
    'product_id'    => 'libgd<script>',
    'component'     => '    10    ',
    'versions'      => '2.0.33',
    'testscalar'    => array('2', '23', '10', '12'),
    'testarray'     => '2',
);
$keys = array(
    'product_id',
    'component',
    'versions',
    'doesnotexist',
    'testscalar',
    'testarray'
);
$options = array(
    'filter' => FILTER_CALLBACK,
    'options' => function ($value) {
        return trim(strip_tags($value));
    },
);
$args = array_fill_keys($keys, $options);
/* Result
$args = array(
    'product_id' => array(
        'filter' => FILTER_CALLBACK,
        'options' => function ($value) {
            return trim(strip_tags($value));
        },
    ),
    'component' => array(
        'filter' => FILTER_CALLBACK,
        'options' => function ($value) {
            return trim(strip_tags($value));
        },
    ),
    'versions' => array(
        'filter' => FILTER_CALLBACK,
        'options' => function ($value) {
            return trim(strip_tags($value));
        },
    ),
    'doesnotexist' => array(
        'filter' => FILTER_CALLBACK,
        'options' => function ($value) {
            return trim(strip_tags($value));
        },
    ),
    'testscalar' => array(
        'filter' => FILTER_CALLBACK,
        'options' => function ($value) {
            return trim(strip_tags($value));
        },
    ),
    'testarray' => array(
        'filter' => FILTER_CALLBACK,
        'options' => function ($value) {
            return trim(strip_tags($value));
        },
    ),
);
*/

$myinputs = filter_var_array($data, $args);
var_dump($myinputs);

Output:

array(6) {
  'product_id' =>
  string(5) "libgd"
  'component' =>
  string(2) "10"
  'versions' =>
  string(6) "2.0.33"
  'doesnotexist' =>
  NULL
  'testscalar' =>
  array(4) {
    [0] =>
    string(1) "2"
    [1] =>
    string(2) "23"
    [2] =>
    string(2) "10"
    [3] =>
    string(2) "12"
  }
  'testarray' =>
  string(1) "2"
}

<?php
//an example of simply sanitize an array..

$data = array(
                '<b>bold</b>',
                '<script>javascript</script>',
                'P*}i@893746%%%p*.i.*}}|.dw<?php echo "echo works!!";?>');

$myinputs = filter_var_array($data,FILTER_SANITIZE_STRING);

var_dump($myinputs);

//OUTPUT:
//formarray(3) { [0]=> string(4) "bold" [1]=> string(10) "javascript" [2]=> string(26) "P*}i@893746%%%p*.i.*}}|.dw" }
?>

For Web API input validation, it can be useful to separate the application-level validation specification from the low-level PHP filtering API.

Some projects use schema validation libraries to keep validation rules independent from the code that actually executes the validation. The same idea can be applied in a small form with filter_var_array(): define field names and rule names in one array, then convert those rule names into PHP filter descriptors.

<?php

$input = [
    'email' => 'taro@example.com', // valid
    'quantity' => '0',             // invalid: less than 1
];

// Application-level specification.
// It maps input field names to application rule names.
$app_spec = [
    'email' => 'email',
    'quantity' => 'quantity',
];

$filter_descriptors = build_filter_descriptors($app_spec);

$result = filter_var_array($input, $filter_descriptors);

var_dump($result);

function build_filter_descriptors(array $app_spec): array
{
    $filter_descriptors = [];

    foreach ($app_spec as $field => $rule_name) {
        $filter_descriptors[$field] = filter_descriptor_for_rule($rule_name);
    }

    return $filter_descriptors;
}

function filter_descriptor_for_rule(string $rule_name): array
{
    return match ($rule_name) {
        'email' => [
            'filter' => FILTER_VALIDATE_EMAIL,
        ],
        'quantity' => [
            'filter' => FILTER_VALIDATE_INT,
            'options' => [
                'min_range' => 1,
                'max_range' => 10,
            ],
        ],
    };
}

FILTER_THROW_ON_FAILURE can be used in each filter descriptor by adding it to the "flags" entry.

<?php

$data = [
    'email' => 'not an email',
    'age' => '20',
];

$filters = [
    'email' => [
        'filter' => FILTER_VALIDATE_EMAIL,
        'flags' => FILTER_THROW_ON_FAILURE,
    ],
    'age' => [
        'filter' => FILTER_VALIDATE_INT,
        'flags' => FILTER_THROW_ON_FAILURE,
        'options' => [
            'min_range' => 0,
            'max_range' => 120,
        ],
    ],
];

try {
    $result = filter_var_array($data, $filters);
} catch (Filter\FilterFailedException $e) {
    echo $e->getMessage(), "\n";
}

?>

When using filter_var_array(), the exception message does not identify which array key failed validation. If you need field-specific validation errors for a form or Web API response, validating each field separately with filter_var() may be easier to handle.

Also note that FILTER_THROW_ON_FAILURE and FILTER_NULL_ON_FAILURE should not be used together.

$emails = [
    'a' => 'email1@domain.com',
    'b' => '<email2>@domain.com',
];

$result = filter_var_array($emails, FILTER_SANITIZE_EMAIL);
print_r($result);

// the result will be...
// array('a' => 'email1@domain.com', 'b' => 'email2@domain.com')