PHP Doku:: Nimmt Variable von Außen entgegen und filtert sie optional - function.filter-input.html

Verlauf / Chronik / History: (1) anzeigen

Sie sind hier:
Doku-StartseitePHP-HandbuchFunktionsreferenzVariablen- und typbezogene ErweiterungenDatenfilterungFilter-Funktionenfilter_input

Ein Service von Reinhard Neidl - Webprogrammierung.





(PHP 5 >= 5.2.0)

filter_inputNimmt Variable von Außen entgegen und filtert sie optional


mixed filter_input ( int $type , string $variable_name [, int $filter [, mixed $options ]] )



Einer von INPUT_GET, INPUT_POST, INPUT_COOKIE, INPUT_SERVER, INPUT_ENV, INPUT_SESSION (not implemented yet) and INPUT_REQUEST (not implemented yet).


Name der Variablen.


Anzuwendender Filter. Standard ist FILTER_DEFAULT.


Assoziatives Array mit Optionen oder bitweise Disjunktion von Flags. Wenn der Filter Optionen akzeptiert, können Flags auch im "flags" Feld des Arrays angegeben werden.


Bei Erfolg wird der Wert zurückgegeben, FALSE im Fehlerfall oder NULL, wenn die Variable variable_name nicht gesetzt ist. Wenn das Flag FILTER_NULL_ON_FAILURE benutzt wurde, wird FALSE zurückgegeben, wenn die Variable nicht gesetzt ist und NULL, wenn das Filtern fehlgeschlagen ist.


Beispiel #1 filter_input() Beispiel

$search_url filter_input(INPUT_GET'search'FILTER_SANITIZE_ENCODED);
"You have searched for $search_html.\n";
"<a href='?search=$search_url'>Search again.</a>";

Das oben gezeigte Beispiel erzeugt eine ähnliche Ausgabe wie:

You have searched for Me &#38; son.
<a href='?search=Me%20%26%20son'>Search again.</a>

Siehe auch

7 BenutzerBeiträge:
- Beiträge aktualisieren...
ss23 at ss23 dot geek dot nz
29.07.2010 8:37
Note that this function doesn't (or at least doesn't seem to) actually filter based on the current values of $_GET etc. Instead, it seems to filter based off the original values.
['search'] = 'foo'; // This has no effect on the filter_input

$search_html = filter_input(INPUT_GET, 'search', FILTER_SANITIZE_SPECIAL_CHARS);
$search_url = filter_input(INPUT_GET, 'search', FILTER_SANITIZE_ENCODED);
"You have searched for $search_html.\n";
"<a href='?search=$search_url'>Search again.</a>";

If you need to set a default input value and filter that, use filter_var on your required input variable instead
travismowens at gmail dot com
28.07.2010 18:21
I wouldn't recommend people use this function to store their data in a database.  It's best not to encode data when storing it, it's better to store it raw and convert in upon the time of need.

One main reason for this is because if you have a short CHAR(16) field and the text contains encoded characters (quotes, ampersand) you can easily take a 12 character entry which obviously fits, but because of encoding it no longer fits.

Also, while not as common, if you need to use this data in another place, such as a non webpage (perhaps in a desktop app, or to a cell phone SMS or to a pager) the HTML encoded data will appear raw, and now you have to decode the data.

In summary, the best way to architect your system, is to store data as raw, and encode it only the moment you need to.  So this means in your PHP upon doing a SQL query, instead of merely doing an   echo $row['title']  you need to run htmlentities() on your echos, or better yet, an abstract function.
med dot k1987 at yahoo dot com
30.06.2010 16:48
Does anybody know how to prevent FILTER_SANITIZE_SPECIAL_CHARS from converting the line breaks (\n) into (&#10;).
I'm developing a simple commenting system for my website and I found that the php filter converts \n to &#10; so when using nl2br() there are no line breaks.
help please.
thanks :)
Maksym Karazeev
3.03.2009 22:13
Just a tip.

Note how to setup default filter for filter_var_array

When I tried to use filter_var_array and didn't mentioned all array indexes in definition it filtered it with some filter and broke values so using this tip corrected everything

= array_map(create_function('', 'return array("filter"=>FILTER_UNSAFE_RAW);'), $input);
Marques Johansson
2.01.2008 20:30
Despite the documentation for 'type', you can specify multiple types by doing:

$test = filter_input(INPUT_GET | INPUT_POST, 'test');

This was tested in 5.2.3.

When both are set it appears to return the value defined first by variables_order (php.ini).

This trick does not seem to work in filter_input_array though.  Neither function supports INPUT_REQUEST at the moment.
vid at phpcult dot com
10.12.2007 9:49
If you want to use the callback filter with filter_input, you need to do something like:

$args = array ('options' => 'mycallbackfunction');

$foobar = filter_input(INPUT_POST,'postedvariable',FILTER_CALLBACK,$args);
anthony dot parsons at manx dot net
23.08.2007 23:10
FastCGI seems to cause strange side-effects with unexpected null values when using INPUT_SERVER and INPUT_ENV with this function. You can use this code to see if it affects your server:
foreach (
array_keys($_SERVER) as $b ) {
var_dump($b, filter_input(INPUT_SERVER, $b));
foreach (
array_keys($_ENV) as $b ) {
var_dump($b, filter_input(INPUT_ENV, $b));
If you want to be on the safe side, using the superglobal $_SERVER and $_ENV variables will always work. You can still use the filter_* functions for Get/Post/Cookie without a problem, which is the important part!

PHP Powered Diese Seite bei
The PHP manual text and comments are covered by the Creative Commons Attribution 3.0 License © the PHP Documentation Group - Impressum - mail("TO:Reinhard Neidl",...)