Summary: in this tutorial, you will learn how to use the PHP filter_input() function to get an external variable by name and filter it.

Introduction to PHP filter_input() function

The PHP filter_input() function allows you to get an external variable by its name and filter it using one or more built-in filters.

The following shows the syntax of the filter_input() function:

Code language: PHP (php)

The filter_input() function has the following parameters:

• $type is one of INPUT_GET, INPUT_POST, INPUT_COOKIE, INPUT_SERVER, and INPUT_ENV.
• $var_name is the name of the variable to filter.
• $filter is the filter id to apply. Here’s the list of valid filters. If you omit the $filter argument, the filter_input() function will use the FILTER_DEFAULT filter id, which doesn’t filter anything.
• $options is an associative array that consists of one or more options. When a filter accepts the options, you can use one or more flags. If you want to use multiple flags, you need to separate them by the (|) e.g., FILTER_SANITIZE_ENCODED | FILTER_SANITIZE_SPECIAL_CHARS.

The filter_input() function returns null, false, or the filtered value according to the following rules:

• If the $var_name is not set, the filte_input() function returns null.
• If the filter fails, the filter_input() function returns false.
• Otherwise, it returns the filtered value of the requested variable.

PHP filter_input() function example

The following example uses the filter_input() function to sanitize data for a search form:

Code language: HTML, XML (xml)

How the form works.

The form contains an input with type search and a submit button.

When you enter a search term, e.g., how to use the filter_input function and click the submit button; the form uses the GET method to append the term query string to the URL, e.g.,

Code language: plaintext (plaintext)

This search form submits to itself (search.php).

The filter_input() function sanitizes the search term using the FILTER_SANITIZE_SPECIAL_CHARS and FILTER_SANITIZE_ENCODED filters.

The FILTER_SANITIZE_SPECIAL_CHARS filter returns a value for showing on the search field and the FILTER_SANITIZE_ENCODED filter returns a value for displaying on the page.

filter_input vs. filter_var

If a variable doesn’t exist, the filter_input() function returns null while the filter_var() function returns an empty string and issues a notice of an undefined index.

Suppose you have a page with the following URL:

Code language: JavaScript (javascript)

The following filter_input() function returns null and doesn’t raise any error when you get the term variable from the INPUT_GET:

Code language: HTML, XML (xml)

Output:

Code language: plaintext (plaintext)

However, the filter_var() function returns an empty string and issues an error:

Code language: HTML, XML (xml)

Output:

Code language: plaintext (plaintext)

Therefore, you often use the isset() or filter_has_var() function to check if a variable is set before passing it to the filter_var() function like this:

Code language: HTML, XML (xml)

Also, the filter_input() function doesn’t get the current values of the $_GET, $_POST, … superglobal variables. Instead, it uses the original values submitted in the HTTP request. For example:

Code language: PHP (php)

Output:

Code language: plaintext (plaintext)

This example attempts to assign a value to the $_GET['term'] variable. However, the filter_input() doesn’t read the term from the current $_GET variable. Therefore, the script displays NULL.

On the other hand, the filter_var() function does read values from the current $_GET variable. For example:

Code language: HTML, XML (xml)

Output:

Code language: JavaScript (javascript)

Summary

• Use the PHP filter_input() function to sanitze and validate data from external variables.