Input validation and sanitization in PHP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to get user input from a POST request safely.

PHP

<?php
$user_input = $_POST[[1]];
?>

Drag options to blanks, or click blank then click option'

Ausername

B"username"

C"user_input"

Dinput

Attempts:

3 left

💡 Hint

Common Mistakes

Forgetting quotes around the key causes a syntax error.

Using a wrong key name returns null.

The key to access POST data must be a string in quotes, like "username".

2fill in blank

medium

Complete the code to sanitize the user input as a string.

PHP

<?php
$clean_input = filter_var($user_input, [1]);
?>

Drag options to blanks, or click blank then click option'

AFILTER_SANITIZE_STRING

BFILTER_VALIDATE_EMAIL

CFILTER_SANITIZE_EMAIL

DFILTER_VALIDATE_INT

Attempts:

3 left

💡 Hint

Common Mistakes

Using validation filters instead of sanitization filters.

Choosing filters meant for emails or numbers.

FILTER_SANITIZE_STRING removes unwanted characters from strings.

3fill in blank

hard

Fix the error in the code to validate if input is an integer.

PHP

<?php
if (filter_var($input, [1]) === false) {
    echo "Invalid number.";
}
?>

Drag options to blanks, or click blank then click option'

AFILTER_VALIDATE_INT

BFILTER_SANITIZE_NUMBER_INT

CFILTER_VALIDATE_BOOLEAN

DFILTER_SANITIZE_STRING

Attempts:

3 left

💡 Hint

Common Mistakes

Using sanitization filters instead of validation filters.

Confusing boolean validation with integer validation.

FILTER_VALIDATE_INT checks if the input is a valid integer.

4fill in blank

hard

Fill both blanks to sanitize and then validate an email input.

PHP

<?php
$email = filter_var($raw_email, [1]);
if (filter_var($email, [2]) === false) {
    echo "Invalid email.";
}
?>

Drag options to blanks, or click blank then click option'

AFILTER_SANITIZE_EMAIL

BFILTER_VALIDATE_INT

CFILTER_VALIDATE_EMAIL

DFILTER_SANITIZE_STRING

Attempts:

3 left

💡 Hint

Common Mistakes

Validating before sanitizing.

Using wrong filters for email validation.

First sanitize the email, then validate it.

5fill in blank

hard

Fill all three blanks to create a sanitized array of usernames longer than 3 characters.

PHP

<?php
$usernames = ['alice', 'bob', 'eve123', 'jo'];
$filtered = array_filter(array_map(function($name) {
    return filter_var($name, [1]);
}, $usernames), function($name) {
    return strlen($name) [2] [3];
});
?>

Drag options to blanks, or click blank then click option'

AFILTER_SANITIZE_STRING

B>

C3

D<

Attempts:

3 left

💡 Hint

Common Mistakes

Using validation filters instead of sanitization.

Using wrong comparison operators or values.

Sanitize each username, then keep only those longer than 3 characters.

Practice

1. What is the main purpose of input validation in PHP?

easy

A. To check if the input data is correct and safe

B. To store data in a database

C. To display data on the screen

D. To create new variables automatically

Solution

1. Step 1: Understand input validation

   Input validation means checking if the data entered by a user meets certain rules and is safe to use.

2. Step 2: Identify the purpose

   The main goal is to ensure data is correct and safe before using it in the program.

3. Final Answer:

   To check if the input data is correct and safe -> Option A

4. Quick Check:

   Input validation = check correctness and safety [OK]

Hint: Validation means checking data correctness and safety [OK]

Common Mistakes:

• Confusing validation with data storage
• Thinking validation displays data
• Assuming validation creates variables

2. Which of the following is the correct syntax to sanitize an email input in PHP?

easy

A. $email = filter_var($_POST['email'], FILTER_SANITIZE_STRING);

B. $email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);

C. $email = filter_var($_POST['email'], FILTER_VALIDATE_INT);

D. $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);

Solution

1. Step 1: Understand sanitization vs validation

   Sanitization cleans data by removing unwanted characters, validation checks if data is valid.

2. Step 2: Identify correct filter for sanitizing email

   FILTER_SANITIZE_EMAIL removes illegal characters from email input.

3. Final Answer:

   $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL); -> Option D

4. Quick Check:

   Sanitize email = FILTER_SANITIZE_EMAIL [OK]

Hint: Sanitize email uses FILTER_SANITIZE_EMAIL in filter_var() [OK]

Common Mistakes:

• Using FILTER_VALIDATE_EMAIL for sanitization
• Using FILTER_VALIDATE_INT for email
• Using FILTER_SANITIZE_STRING for email

3. What will be the output of this PHP code?

$input = "";
$clean = filter_var($input, FILTER_SANITIZE_STRING);
echo $clean;

medium

A. alert('Hi');</script>

B. <script>alert('Hi');</script>

C. alert('Hi');

D. Syntax error

Solution

1. Step 1: Understand FILTER_SANITIZE_STRING behavior

   This filter removes tags and encodes or strips HTML tags from the string.

2. Step 2: Apply filter to input

   The input contains a script tag; sanitizing removes the <script> and </script> tags, leaving only "alert('Hi');".

3. Final Answer:

   alert('Hi'); -> Option C

4. Quick Check:

   Sanitize string removes tags = alert('Hi'); [OK]

Hint: FILTER_SANITIZE_STRING removes HTML tags from input [OK]

Common Mistakes:

• Expecting tags to remain
• Confusing sanitization with validation
• Thinking code runs or causes error

4. Identify the error in this PHP code snippet for validating an integer input:

$age = $_POST['age'];
if (filter_var($age, FILTER_SANITIZE_INT)) {
    echo "Valid age";
} else {
    echo "Invalid age";
}

medium

A. Missing semicolon after echo statements

B. FILTER_SANITIZE_INT should be FILTER_VALIDATE_INT

C. Using $_POST without quotes

D. filter_var() cannot validate integers

Solution

1. Step 1: Understand difference between sanitize and validate

   FILTER_SANITIZE_INT cleans input by removing non-numeric characters but does not validate if input is a valid integer.

2. Step 2: Correct filter for validation

   To check if input is a valid integer, use FILTER_VALIDATE_INT instead of FILTER_SANITIZE_INT.

3. Final Answer:

   FILTER_SANITIZE_INT should be FILTER_VALIDATE_INT -> Option B

4. Quick Check:

   Validation needs FILTER_VALIDATE_INT, not sanitize [OK]

Hint: Use FILTER_VALIDATE_INT to check integers, not sanitize [OK]

Common Mistakes:

• Confusing sanitize with validate filters
• Ignoring filter_var() return values
• Assuming sanitize validates input

5. You want to accept a username that only contains letters, numbers, and underscores. Which PHP code correctly validates this input using filter_var() and a custom pattern?

hard

A. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_REGEXP, ['options' => ['regexp' => '/^[a-zA-Z0-9_]+$/']])) {
echo "Valid username";
} else {
echo "Invalid username";
}

B. $username = $_POST['username'];
if (filter_var($username, FILTER_SANITIZE_STRING)) {
echo "Valid username";
} else {
echo "Invalid username";
}

C. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_EMAIL)) {
echo "Valid username";
} else {
echo "Invalid username";
}

D. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_INT)) {
echo "Valid username";
} else {
echo "Invalid username";
}

Solution

1. Step 1: Understand the requirement

   The username must only have letters, numbers, and underscores, so a regular expression is needed to check this pattern.

2. Step 2: Use FILTER_VALIDATE_REGEXP with correct pattern

   FILTER_VALIDATE_REGEXP allows validating input against a regex pattern. The pattern '/^[a-zA-Z0-9_]+$/' matches only allowed characters.

3. Step 3: Eliminate distractors

   The incorrect options use filters for integer validation, string sanitization, or email validation, none of which enforce the specific pattern of letters, numbers, and underscores.

4. Final Answer:

   Code using FILTER_VALIDATE_REGEXP with pattern '/^[a-zA-Z0-9_]+$/' -> Option A

5. Quick Check:

   Validate username with FILTER_VALIDATE_REGEXP + regex [OK]

Hint: Use FILTER_VALIDATE_REGEXP with regex for custom pattern validation [OK]

Common Mistakes:

• Using sanitize instead of validate
• Using email or int filters for username
• Not using regex for pattern matching