PHP Filter
Filter constants and functions reference.
Key PointsValidate filters return `false`; sanitise filters return a string. Do not mix them.
Functions
| Function | Purpose |
|---|---|
| filter_var | 过滤单个值 |
| filter_var_array | 按规则表批量过滤 |
| filter_input | 从 $_GET / $_POST 等直接取并过滤 |
| filter_input_array | 批量版 filter_input |
| filter_has_var | 判断输入变量是否存在 |
| filter_list | 列出所有可用过滤器 |
| filter_id | 按名字取过滤器 ID |
Validate filters
PHP
<?php
$cases = [
["email", "tom@example.com", FILTER_VALIDATE_EMAIL],
["email", "tom@", FILTER_VALIDATE_EMAIL],
["url", "https://example.com", FILTER_VALIDATE_URL],
["ip", "192.168.1.1", FILTER_VALIDATE_IP],
["bool", "yes", FILTER_VALIDATE_BOOLEAN],
["bool", "maybe", FILTER_VALIDATE_BOOLEAN],
["int", "42", FILTER_VALIDATE_INT],
["int", "4.2", FILTER_VALIDATE_INT],
["mac", "00:1A:2B:3C:4D:5E", FILTER_VALIDATE_MAC],
];
foreach ($cases as [$type, $val, $f]) {
$r = filter_var($val, $f);
echo $type . " " . $val . " => " . ($r === false ? "失败" : var_export($r, true)) . "\n";
}Output
email tom@example.com => 'tom@example.com'
email tom@ => 失败
url https://example.com => 'https://example.com'
ip 192.168.1.1 => '192.168.1.1'
bool yes => true
bool maybe => 失败
int 42 => 42
int 4.2 => 失败
mac 00:1A:2B:3C:4D:5E => '00:1A:2B:3C:4D:5E'Sanitise filters
PHP
<?php
echo filter_var(" a b ", FILTER_SANITIZE_SPECIAL_CHARS), "|\n";
echo filter_var("a1b2c3", FILTER_SANITIZE_NUMBER_INT), "\n";
echo filter_var("1.5abc", FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION), "\n";
echo filter_var("a b@c d.com", FILTER_SANITIZE_EMAIL), "\n";
echo filter_var("<p>x</p>", FILTER_SANITIZE_FULL_SPECIAL_CHARS), "\n";Output
a b |
123
1.5
ab@cd.com
<p>x</p>FILTER_SANITIZE_SPECIAL_CHARS does not escape single quotes; htmlspecialchars($v, ENT_QUOTES) does. Inside value='...' the former fails. **Prefer htmlspecialchars with ENT_QUOTES.**filter_input
PHP
<?php
// 等价于 filter_var($_GET["id"] ?? null, FILTER_VALIDATE_INT)
$id = filter_input(INPUT_GET, "id", FILTER_VALIDATE_INT);
// 带默认值
$page = filter_input(INPUT_GET, "page", FILTER_VALIDATE_INT, [
"options" => ["default" => 1, "min_range" => 1],
]);
echo $id === null ? "参数缺失" : ($id === false ? "格式错误" : "id=$id"), "\n";
echo "page=$page\n";
var_dump(filter_has_var(INPUT_GET, "id"));Output
参数缺失
page=1
bool(false)filter_input is tri-state: null means missing, false means invalid, anything else is the value. Stronger than filter_var, which conflates the two.
Custom callback
PHP
<?php
$slug = filter_var("Hello World 2023", FILTER_CALLBACK, [
"options" => fn($v) => strtolower(str_replace(" ", "-", trim($v))),
]);
echo $slug, "\n";
$r = filter_var_array(
["a" => " 1 ", "b" => "2"],
["a" => ["filter" => FILTER_CALLBACK, "options" => "intval"],
"b" => FILTER_VALIDATE_INT]
);
print_r($r);Output
hello-world-2023
Array
(
[a] => 1
[b] => 2
)函数
| 函数 | 作用 |
|---|---|
| filter_var | 过滤单个值 |
| filter_var_array | 按规则表批量过滤 |
| filter_input | 从 $_GET / $_POST 等直接取并过滤 |
| filter_input_array | 批量版 filter_input |
| filter_has_var | 判断输入变量是否存在 |
| filter_list | 列出所有可用过滤器 |
| filter_id | 按名字取过滤器 ID |
验证类过滤器
PHP
<?php
$cases = [
["email", "tom@example.com", FILTER_VALIDATE_EMAIL],
["email", "tom@", FILTER_VALIDATE_EMAIL],
["url", "https://example.com", FILTER_VALIDATE_URL],
["ip", "192.168.1.1", FILTER_VALIDATE_IP],
["bool", "yes", FILTER_VALIDATE_BOOLEAN],
["bool", "maybe", FILTER_VALIDATE_BOOLEAN],
["int", "42", FILTER_VALIDATE_INT],
["int", "4.2", FILTER_VALIDATE_INT],
["mac", "00:1A:2B:3C:4D:5E", FILTER_VALIDATE_MAC],
];
foreach ($cases as [$type, $val, $f]) {
$r = filter_var($val, $f);
echo $type . " " . $val . " => " . ($r === false ? "失败" : var_export($r, true)) . "\n";
}Output
email tom@example.com => 'tom@example.com'
email tom@ => 失败
url https://example.com => 'https://example.com'
ip 192.168.1.1 => '192.168.1.1'
bool yes => true
bool maybe => 失败
int 42 => 42
int 4.2 => 失败
mac 00:1A:2B:3C:4D:5E => '00:1A:2B:3C:4D:5E'清洗类过滤器
PHP
<?php
echo filter_var(" a b ", FILTER_SANITIZE_SPECIAL_CHARS), "|\n";
echo filter_var("a1b2c3", FILTER_SANITIZE_NUMBER_INT), "\n";
echo filter_var("1.5abc", FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION), "\n";
echo filter_var("a b@c d.com", FILTER_SANITIZE_EMAIL), "\n";
echo filter_var("<p>x</p>", FILTER_SANITIZE_FULL_SPECIAL_CHARS), "\n";Output
a b |
123
1.5
ab@cd.com
<p>x</p>FILTER_SANITIZE_SPECIAL_CHARS 不转义单引号，而 htmlspecialchars($v, ENT_QUOTES) 会。放在 HTML 属性里（value='...'）时前者挡不住注入。**输出转义优先用 htmlspecialchars 带 ENT_QUOTES。**filter_input
PHP
<?php
// 等价于 filter_var($_GET["id"] ?? null, FILTER_VALIDATE_INT)
$id = filter_input(INPUT_GET, "id", FILTER_VALIDATE_INT);
// 带默认值
$page = filter_input(INPUT_GET, "page", FILTER_VALIDATE_INT, [
"options" => ["default" => 1, "min_range" => 1],
]);
echo $id === null ? "参数缺失" : ($id === false ? "格式错误" : "id=$id"), "\n";
echo "page=$page\n";
var_dump(filter_has_var(INPUT_GET, "id"));Output
参数缺失
page=1
bool(false)filter_input 的三态很有用：null 表示参数不存在，false 表示存在但非法，其他值是结果。这比 filter_var 强——后者对缺失和非法都返回 false。
自定义回调
PHP
<?php
$slug = filter_var("Hello World 2023", FILTER_CALLBACK, [
"options" => fn($v) => strtolower(str_replace(" ", "-", trim($v))),
]);
echo $slug, "\n";
$r = filter_var_array(
["a" => " 1 ", "b" => "2"],
["a" => ["filter" => FILTER_CALLBACK, "options" => "intval"],
"b" => FILTER_VALIDATE_INT]
);
print_r($r);Output
hello-world-2023
Array
(
[a] => 1
[b] => 2
)