← Back to PHP Course | Chapter 10: Forms & Validation | Lesson 8 of 8

PHP Filters Advanced

Basic filtering with filter_var() covers common cases like validating an email or an integer, but PHP's filter functions go further -- filtering entire arrays at once, applying custom callback filters for rules PHP does not have built in, and combining multiple filter flags for finer control over exactly what counts as valid.

In this page:

  1. Filtering an Entire Array with filter_var_array()
  2. Writing a Custom Filter with FILTER_CALLBACK
  3. Fine-Tuning Filters with Flags
  4. Sanitizing Multiple Fields at Once
  5. Filtering Superglobal Input Directly
Syntax
php 
$result = filter_var_array($data, ["key" => FILTER_VALIDATE_EMAIL, "key2" => FILTER_VALIDATE_INT]);

$result = filter_var($value, FILTER_CALLBACK, ["options" => "function_name"]);
$result = filter_var($value, FILTER_VALIDATE_INT, FILTER_FLAG_ALLOW_THOUSAND);

Filtering an Entire Array with filter_var_array()

filter_var_array($data, $rules) applies a different filter to every key in an array in one call, following a $rules array that maps each key name to the filter it should use -- much more convenient than calling filter_var() separately for every single form field.

Note: Define your filter rules array once, close to where the form fields are declared, so validation rules stay easy to find and update alongside the fields they apply to.
Warning: A key present in $data but missing from the $rules array is passed through completely unfiltered by default -- explicitly include every key you want validated.

Example: Filtering an Entire Array with filter_var_array()

php 
<?php
// Declare `$data` as an array: `["email" => "[email protected]", "age" => "25"]`
$data = ["email" => "[email protected]", "age" => "25"];
// Declare `$rules` as an array: `["email" => FILTER_VALIDATE_EMAIL, "age" => FILTER_VALIDATE_INT]`
$rules = ["email" => FILTER_VALIDATE_EMAIL, "age" => FILTER_VALIDATE_INT];
// Print a human-readable dump of `filter_var_array($data, $rules)`
print_r(filter_var_array($data, $rules));
?>

Writing a Custom Filter with FILTER_CALLBACK

FILTER_CALLBACK lets you supply your own function as the validation rule, for checks PHP's built-in filters do not directly support -- like confirming a username only contains letters, numbers, and underscores, or that a value matches a business-specific rule.

Note: Have your callback function return false explicitly for invalid input, matching the same success/failure convention every built-in filter follows.
Warning: A FILTER_CALLBACK function that forgets to return anything on the invalid path implicitly returns null, which can be mistaken for a passing result if not checked carefully.

Example: Writing a Custom Filter with FILTER_CALLBACK

php 
<?php
// Declare `$username`, set to "alice_99"
$username = "alice_99";
$options = ["options" => function ($value) {
    // Return `preg_match('/^\w+$/', $value) ? $value : false` from this function
    return preg_match('/^\w+$/', $value) ? $value : false;
}];
// Print a detailed dump (with types) of `filter_var($username, FILTER_CALLBACK, $options)`
var_dump(filter_var($username, FILTER_CALLBACK, $options));
?>

Fine-Tuning Filters with Flags

Many filters accept additional flags to adjust their exact behavior -- FILTER_FLAG_ALLOW_THOUSAND lets FILTER_VALIDATE_INT accept thousands separators, and FILTER_NULL_ON_FAILURE changes a boolean filter to return null (instead of false) specifically for unrecognized input, distinguishing it from a genuine "false" value.

Note: Check the PHP manual's filter flag list for the specific filter you are using -- many filters support multiple flags that can be combined with the bitwise OR operator.
Warning: Combining incompatible flags for a given filter type has no defined effect and can behave inconsistently -- only combine flags documented as compatible together.

Example: Fine-Tuning Filters with Flags

php 
<?php
// Print a detailed dump (with types) of `filter_var("1,000", FILTER_VALIDATE_INT, FILTER_FLAG_ALLOW_THOUSAND)`
var_dump(filter_var("1,000", FILTER_VALIDATE_INT, FILTER_FLAG_ALLOW_THOUSAND));
// Print a detailed dump (with types) of `filter_var("maybe", FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE)`
var_dump(filter_var("maybe", FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE));
?>

Sanitizing Multiple Fields at Once

filter_var_array() works for sanitization filters too, not just validation ones -- applying FILTER_SANITIZE_STRING-style cleanup or FILTER_SANITIZE_NUMBER_INT across an entire array of submitted fields in one call, cleaning up several inputs simultaneously.

Note: Sanitize first, then validate, when a field genuinely needs both steps -- sanitizing removes unwanted characters, while validation confirms the cleaned value is actually correct.
Warning: Sanitization filters strip or encode characters rather than rejecting invalid input outright -- they do not replace validation, since sanitized-but-still-wrong data can still pass through.

Example: Sanitizing Multiple Fields at Once

php 
<?php
// Declare `$data` as an array: `["age" => "25abc", "phone" => "555-1234"]`
$data = ["age" => "25abc", "phone" => "555-1234"];
// Declare `$rules` as an array: `["age" => FILTER_SANITIZE_NUMBER_INT, "phone" => FILTER_SANITIZE_NUMBER_INT]`
$rules = ["age" => FILTER_SANITIZE_NUMBER_INT, "phone" => FILTER_SANITIZE_NUMBER_INT];
// Print a human-readable dump of `filter_var_array($data, $rules)`
print_r(filter_var_array($data, $rules));
?>

Filtering Superglobal Input Directly

filter_input(INPUT_GET, "key", $filter) or filter_input(INPUT_POST, "key", $filter) reads and filters a value directly from the $_GET or $_POST superglobals in one step, without touching the raw superglobal array at all -- a slightly safer, more explicit pattern than reading and then separately filtering.

Note: filter_input() returns null if the requested key was not present at all, distinct from false, which means the key existed but failed the filter -- check for both cases separately.
Warning: filter_input() reads directly from PHP's internal request data at the time it was first parsed -- it will not reflect changes your own script makes to $_GET or $_POST afterward.

Example: Filtering Superglobal Input Directly

php 
<?php
// Set `$_GET['id']` to "42"
$_GET['id'] = "42";
// Declare `$id`, set to `filter_input(INPUT_GET, "id", FILTER_VALIDATE_INT)`
$id = filter_input(INPUT_GET, "id", FILTER_VALIDATE_INT);
// Print a detailed dump (with types) of `$id`
var_dump($id);
?>
Related Topics

PHP Filters · PHP Match Expression Advanced · PHP Form Complete · PHP CSRF Protection

{# common_mistakes/chapter_summary/browser_support: on Hindi pages the view already swaps in the hi_ translation fields (or blanks these out if untranslated), so this renders correctly for both languages without a lang_code check here. #}
Common Mistakes
  1. Forgetting that filter_var() returns false on failure for most filters, which is itself a valid boolean value -- always compare with === false rather than a loose truthy check.
  2. Not realizing FILTER_VALIDATE_INT and similar filters reject values with leading/trailing whitespace by default unless the appropriate flag is added.
  3. Writing a custom FILTER_CALLBACK function that does not itself return false on invalid input, breaking the consistent success/failure contract other filters follow.
Chapter Summary
  • filter_var_array() applies filters to every value in an array at once, following a rules array that maps keys to filter definitions.
  • FILTER_CALLBACK lets you supply your own custom validation function for rules PHP's built-in filters do not cover.
  • Filter flags like FILTER_FLAG_ALLOW_THOUSAND or FILTER_NULL_ON_FAILURE fine-tune exactly how a filter behaves.
Browser Support

The full PHP filter extension, including filter_var_array() and FILTER_CALLBACK, has been available since PHP 5.2.

🔒

Chapter Quiz — Complete all 8 topics to unlock

0/8 topics done

Complete these topics first:

← Previous Lesson PHP Filters Next Lesson → PHP Form Complete

Login to run this code

C/C++/Java/PHP execution requires a free account. Your code is saved — you'll land right back in the editor after logging in.