Input validation and sanitization in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is input validation in PHP?

Input validation is the process of checking if the data provided by the user meets the expected format, type, or rules before using it in the program.

beginner

What does input sanitization mean?

Input sanitization means cleaning or modifying user input to remove or escape harmful characters to prevent security issues like SQL injection or cross-site scripting.

beginner

Which PHP function can be used to check if an email is valid?

The function filter_var() with the FILTER_VALIDATE_EMAIL flag checks if an email address is valid.

intermediate

How does htmlspecialchars() help in input sanitization?

htmlspecialchars() converts special characters to HTML entities, preventing malicious code from running in the browser.

beginner

Why should you never trust user input directly?

User input can be incorrect or harmful. Validating and sanitizing input protects your program from errors and security attacks.

Which PHP function is used to validate an integer input?

A filter_var() with FILTER_VALIDATE_INT

B htmlspecialchars()

C trim()

D strtolower()

filter_var() with FILTER_VALIDATE_INT checks if the input is a valid integer.

What does the PHP function trim() do?

A Escapes quotes in a string

B Converts special characters to HTML entities

C Checks if input is a valid email

D Removes whitespace from the beginning and end of a string

trim() removes spaces or other whitespace characters from the start and end of a string.

Why is input sanitization important?

A To change the input type

B To prevent security risks like SQL injection and XSS

C To make the input longer

D To speed up the program

Sanitization cleans input to stop harmful code from causing security problems.

Which filter validates an email address in PHP?

A FILTER_VALIDATE_INT

B FILTER_SANITIZE_EMAIL

C FILTER_VALIDATE_EMAIL

D FILTER_SANITIZE_STRING

FILTER_VALIDATE_EMAIL checks if the input is a valid email format.

What is the main difference between validation and sanitization?

A Validation checks correctness; sanitization cleans input

B Validation cleans input; sanitization checks correctness

C Both do the same thing

D Neither is needed for user input

Validation ensures input is correct; sanitization removes harmful parts.

Explain how you would validate and sanitize a user's email input in PHP.

Think about checking format first, then cleaning unwanted characters.

Describe why input validation and sanitization are important for web security.

Consider what could happen if you trust user input blindly.