Input validation and sanitization in PHP - Mini Project: Build & Apply

Input Validation and Sanitization

📖 Scenario: You are building a simple PHP script that accepts user input from a form. To keep the data safe and clean, you need to validate and sanitize the input before using it.

🎯 Goal: Create a PHP script that takes a user's name and email, validates the email format, sanitizes the name to remove unwanted characters, and then displays the cleaned data.

📋 What You'll Learn

Create variables to hold user input for name and email

Sanitize the name input to remove HTML tags and extra spaces

Validate the email input to ensure it is a proper email format

Display the sanitized name and validated email

💡 Why This Matters

🌍 Real World

Validating and sanitizing user input is essential to keep websites safe and data clean. It prevents errors and security problems like code injection.

💼 Career

Web developers and backend programmers regularly validate and sanitize inputs to protect applications and ensure data quality.

1

Create variables for user input

Create two variables called $name and $email and assign them these exact values: ' John Doe ' for $name and '[e-mail]' for $email.

PHP

# Create variables $name and $email with the given values
# Your code here

Hint

Use simple assignment to create variables with the exact strings given.

2

Sanitize the name input

Create a new variable called $clean_name that removes HTML tags from $name using strip_tags() and trims extra spaces using trim().

PHP

John Doe  ';
$email = '[e-mail]';

# Sanitize $name to create $clean_name
# Your code here

Hint

Use strip_tags() first to remove HTML, then trim() to remove spaces.

3

Validate the email input

Create a variable called $valid_email that uses filter_var() with FILTER_VALIDATE_EMAIL to check if $email is valid. If valid, assign the email to $valid_email, otherwise assign false.

PHP

John Doe  ';
$email = '[e-mail]';

$clean_name = trim(strip_tags($name));

# Validate $email and assign to $valid_email or false
# Your code here

Hint

Use filter_var() with FILTER_VALIDATE_EMAIL to check the email.

4

Display the sanitized name and validated email

Use echo to print the text: Name: followed by $clean_name and a new line, then Email: followed by $valid_email. If $valid_email is false, print Invalid email instead of the email.

PHP

John Doe  ';
$email = '[e-mail]';

$clean_name = trim(strip_tags($name));

$valid_email = filter_var($email, FILTER_VALIDATE_EMAIL);

# Print the sanitized name and validated email or 'Invalid email'
# Your code here

Hint

Use an if statement to check if $valid_email is false and print accordingly.

Practice

1. What is the main purpose of input validation in PHP?

easy

A. To check if the input data is correct and safe

B. To store data in a database

C. To display data on the screen

D. To create new variables automatically

Solution

1. Step 1: Understand input validation

   Input validation means checking if the data entered by a user meets certain rules and is safe to use.

2. Step 2: Identify the purpose

   The main goal is to ensure data is correct and safe before using it in the program.

3. Final Answer:

   To check if the input data is correct and safe -> Option A

4. Quick Check:

   Input validation = check correctness and safety [OK]

Hint: Validation means checking data correctness and safety [OK]

Common Mistakes:

• Confusing validation with data storage
• Thinking validation displays data
• Assuming validation creates variables

2. Which of the following is the correct syntax to sanitize an email input in PHP?

easy

A. $email = filter_var($_POST['email'], FILTER_SANITIZE_STRING);

B. $email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);

C. $email = filter_var($_POST['email'], FILTER_VALIDATE_INT);

D. $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);

Solution

1. Step 1: Understand sanitization vs validation

   Sanitization cleans data by removing unwanted characters, validation checks if data is valid.

2. Step 2: Identify correct filter for sanitizing email

   FILTER_SANITIZE_EMAIL removes illegal characters from email input.

3. Final Answer:

   $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL); -> Option D

4. Quick Check:

   Sanitize email = FILTER_SANITIZE_EMAIL [OK]

Hint: Sanitize email uses FILTER_SANITIZE_EMAIL in filter_var() [OK]

Common Mistakes:

• Using FILTER_VALIDATE_EMAIL for sanitization
• Using FILTER_VALIDATE_INT for email
• Using FILTER_SANITIZE_STRING for email

3. What will be the output of this PHP code?

$input = "";
$clean = filter_var($input, FILTER_SANITIZE_STRING);
echo $clean;

medium

A. alert('Hi');</script>

B. <script>alert('Hi');</script>

C. alert('Hi');

D. Syntax error

Solution

1. Step 1: Understand FILTER_SANITIZE_STRING behavior

   This filter removes tags and encodes or strips HTML tags from the string.

2. Step 2: Apply filter to input

   The input contains a script tag; sanitizing removes the <script> and </script> tags, leaving only "alert('Hi');".

3. Final Answer:

   alert('Hi'); -> Option C

4. Quick Check:

   Sanitize string removes tags = alert('Hi'); [OK]

Hint: FILTER_SANITIZE_STRING removes HTML tags from input [OK]

Common Mistakes:

• Expecting tags to remain
• Confusing sanitization with validation
• Thinking code runs or causes error

4. Identify the error in this PHP code snippet for validating an integer input:

$age = $_POST['age'];
if (filter_var($age, FILTER_SANITIZE_INT)) {
    echo "Valid age";
} else {
    echo "Invalid age";
}

medium

A. Missing semicolon after echo statements

B. FILTER_SANITIZE_INT should be FILTER_VALIDATE_INT

C. Using $_POST without quotes

D. filter_var() cannot validate integers

Solution

1. Step 1: Understand difference between sanitize and validate

   FILTER_SANITIZE_INT cleans input by removing non-numeric characters but does not validate if input is a valid integer.

2. Step 2: Correct filter for validation

   To check if input is a valid integer, use FILTER_VALIDATE_INT instead of FILTER_SANITIZE_INT.

3. Final Answer:

   FILTER_SANITIZE_INT should be FILTER_VALIDATE_INT -> Option B

4. Quick Check:

   Validation needs FILTER_VALIDATE_INT, not sanitize [OK]

Hint: Use FILTER_VALIDATE_INT to check integers, not sanitize [OK]

Common Mistakes:

• Confusing sanitize with validate filters
• Ignoring filter_var() return values
• Assuming sanitize validates input

5. You want to accept a username that only contains letters, numbers, and underscores. Which PHP code correctly validates this input using filter_var() and a custom pattern?

hard

A. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_REGEXP, ['options' => ['regexp' => '/^[a-zA-Z0-9_]+$/']])) {
echo "Valid username";
} else {
echo "Invalid username";
}

B. $username = $_POST['username'];
if (filter_var($username, FILTER_SANITIZE_STRING)) {
echo "Valid username";
} else {
echo "Invalid username";
}

C. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_EMAIL)) {
echo "Valid username";
} else {
echo "Invalid username";
}

D. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_INT)) {
echo "Valid username";
} else {
echo "Invalid username";
}

Solution

1. Step 1: Understand the requirement

   The username must only have letters, numbers, and underscores, so a regular expression is needed to check this pattern.

2. Step 2: Use FILTER_VALIDATE_REGEXP with correct pattern

   FILTER_VALIDATE_REGEXP allows validating input against a regex pattern. The pattern '/^[a-zA-Z0-9_]+$/' matches only allowed characters.

3. Step 3: Eliminate distractors

   The incorrect options use filters for integer validation, string sanitization, or email validation, none of which enforce the specific pattern of letters, numbers, and underscores.

4. Final Answer:

   Code using FILTER_VALIDATE_REGEXP with pattern '/^[a-zA-Z0-9_]+$/' -> Option A

5. Quick Check:

   Validate username with FILTER_VALIDATE_REGEXP + regex [OK]

Hint: Use FILTER_VALIDATE_REGEXP with regex for custom pattern validation [OK]

Common Mistakes:

• Using sanitize instead of validate
• Using email or int filters for username
• Not using regex for pattern matching