Input validation and sanitization in PHP - Time & Space Complexity

Time Complexity: Input validation and sanitization

O(n)

Understanding Time Complexity

When checking and cleaning user input in PHP, it is important to know how the time needed grows as the input gets bigger.

We want to see how the work done changes when the input size changes.

Scenario Under Consideration

Analyze the time complexity of the following code snippet.

function sanitizeInput(array $inputs): array {
    $cleaned = [];
    foreach ($inputs as $key => $value) {
        $trimmed = trim($value);
        $safe = htmlspecialchars($trimmed, ENT_QUOTES, 'UTF-8');
        $cleaned[$key] = $safe;
    }
    return $cleaned;
}

This code takes an array of user inputs, trims spaces, and converts special characters to safe HTML entities.

Identify Repeating Operations

Identify the loops, recursion, array traversals that repeat.

• Primary operation: Looping through each input item once.
• How many times: Once for each input element in the array.

How Execution Grows With Input

As the number of inputs grows, the work grows in a straight line because each input is handled one by one.

Input Size (n)	Approx. Operations
10	About 10 times the work
100	About 100 times the work
1000	About 1000 times the work

Pattern observation: The work increases evenly as input size increases.

Final Time Complexity

Time Complexity: O(n)

This means the time to clean inputs grows directly with the number of inputs.

Common Mistake

[X] Wrong: "Sanitizing input is instant no matter how many items there are."

[OK] Correct: Each input needs its own cleaning step, so more inputs mean more work.

Interview Connect

Understanding how input validation scales helps you write secure and efficient code, a skill valued in many coding challenges and real projects.

Self-Check

"What if we added nested arrays inside inputs? How would the time complexity change?"

Practice

1. What is the main purpose of input validation in PHP?

easy

A. To check if the input data is correct and safe

B. To store data in a database

C. To display data on the screen

D. To create new variables automatically

Solution

1. Step 1: Understand input validation

   Input validation means checking if the data entered by a user meets certain rules and is safe to use.

2. Step 2: Identify the purpose

   The main goal is to ensure data is correct and safe before using it in the program.

3. Final Answer:

   To check if the input data is correct and safe -> Option A

4. Quick Check:

   Input validation = check correctness and safety [OK]

Hint: Validation means checking data correctness and safety [OK]

Common Mistakes:

• Confusing validation with data storage
• Thinking validation displays data
• Assuming validation creates variables

2. Which of the following is the correct syntax to sanitize an email input in PHP?

easy

A. $email = filter_var($_POST['email'], FILTER_SANITIZE_STRING);

B. $email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);

C. $email = filter_var($_POST['email'], FILTER_VALIDATE_INT);

D. $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);

Solution

1. Step 1: Understand sanitization vs validation

   Sanitization cleans data by removing unwanted characters, validation checks if data is valid.

2. Step 2: Identify correct filter for sanitizing email

   FILTER_SANITIZE_EMAIL removes illegal characters from email input.

3. Final Answer:

   $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL); -> Option D

4. Quick Check:

   Sanitize email = FILTER_SANITIZE_EMAIL [OK]

Hint: Sanitize email uses FILTER_SANITIZE_EMAIL in filter_var() [OK]

Common Mistakes:

• Using FILTER_VALIDATE_EMAIL for sanitization
• Using FILTER_VALIDATE_INT for email
• Using FILTER_SANITIZE_STRING for email

3. What will be the output of this PHP code?

$input = "";
$clean = filter_var($input, FILTER_SANITIZE_STRING);
echo $clean;

medium

A. alert('Hi');</script>

B. <script>alert('Hi');</script>

C. alert('Hi');

D. Syntax error

Solution

1. Step 1: Understand FILTER_SANITIZE_STRING behavior

   This filter removes tags and encodes or strips HTML tags from the string.

2. Step 2: Apply filter to input

   The input contains a script tag; sanitizing removes the <script> and </script> tags, leaving only "alert('Hi');".

3. Final Answer:

   alert('Hi'); -> Option C

4. Quick Check:

   Sanitize string removes tags = alert('Hi'); [OK]

Hint: FILTER_SANITIZE_STRING removes HTML tags from input [OK]

Common Mistakes:

• Expecting tags to remain
• Confusing sanitization with validation
• Thinking code runs or causes error

4. Identify the error in this PHP code snippet for validating an integer input:

$age = $_POST['age'];
if (filter_var($age, FILTER_SANITIZE_INT)) {
    echo "Valid age";
} else {
    echo "Invalid age";
}

medium

A. Missing semicolon after echo statements

B. FILTER_SANITIZE_INT should be FILTER_VALIDATE_INT

C. Using $_POST without quotes

D. filter_var() cannot validate integers

Solution

1. Step 1: Understand difference between sanitize and validate

   FILTER_SANITIZE_INT cleans input by removing non-numeric characters but does not validate if input is a valid integer.

2. Step 2: Correct filter for validation

   To check if input is a valid integer, use FILTER_VALIDATE_INT instead of FILTER_SANITIZE_INT.

3. Final Answer:

   FILTER_SANITIZE_INT should be FILTER_VALIDATE_INT -> Option B

4. Quick Check:

   Validation needs FILTER_VALIDATE_INT, not sanitize [OK]

Hint: Use FILTER_VALIDATE_INT to check integers, not sanitize [OK]

Common Mistakes:

• Confusing sanitize with validate filters
• Ignoring filter_var() return values
• Assuming sanitize validates input

5. You want to accept a username that only contains letters, numbers, and underscores. Which PHP code correctly validates this input using filter_var() and a custom pattern?

hard

A. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_REGEXP, ['options' => ['regexp' => '/^[a-zA-Z0-9_]+$/']])) {
echo "Valid username";
} else {
echo "Invalid username";
}

B. $username = $_POST['username'];
if (filter_var($username, FILTER_SANITIZE_STRING)) {
echo "Valid username";
} else {
echo "Invalid username";
}

C. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_EMAIL)) {
echo "Valid username";
} else {
echo "Invalid username";
}

D. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_INT)) {
echo "Valid username";
} else {
echo "Invalid username";
}

Solution

1. Step 1: Understand the requirement

   The username must only have letters, numbers, and underscores, so a regular expression is needed to check this pattern.

2. Step 2: Use FILTER_VALIDATE_REGEXP with correct pattern

   FILTER_VALIDATE_REGEXP allows validating input against a regex pattern. The pattern '/^[a-zA-Z0-9_]+$/' matches only allowed characters.

3. Step 3: Eliminate distractors

   The incorrect options use filters for integer validation, string sanitization, or email validation, none of which enforce the specific pattern of letters, numbers, and underscores.

4. Final Answer:

   Code using FILTER_VALIDATE_REGEXP with pattern '/^[a-zA-Z0-9_]+$/' -> Option A

5. Quick Check:

   Validate username with FILTER_VALIDATE_REGEXP + regex [OK]

Hint: Use FILTER_VALIDATE_REGEXP with regex for custom pattern validation [OK]

Common Mistakes:

• Using sanitize instead of validate
• Using email or int filters for username
• Not using regex for pattern matching