Input validation and sanitization in PHP - Step-by-Step Execution

Concept Flow - Input validation and sanitization

User Input Received

↓

Validate Input Format?

No→Reject Input

Yes↓

Sanitize Input to Remove Bad Data

↓

Use Clean Input in Program

↓

End

Input is first checked for correct format, then cleaned to remove harmful parts before use.

Execution Sample

PHP

<?php
$input = "<script>alert('x')</script>123";
if (ctype_digit($input)) {
  $clean = filter_var($input, FILTER_SANITIZE_NUMBER_INT);
  echo $clean;
} else {
  echo "Invalid input";
}
?>

This code checks if input is digits only, sanitizes it to keep numbers, then prints it or shows error.

Execution Table

Step	Action	Input Value	Validation Result	Sanitized Value	Output
1	Receive input	<script>alert('x')</script>123
2	Check if input is digits only	<script>alert('x')</script>123	False
3	Validation failed	<script>alert('x')</script>123	False		Invalid input
4	End

💡 Input contains non-digit characters, so validation fails and input is rejected.

Variable Tracker

Variable	Start	After Validation	After Sanitization	Final
$input	"<script>alert('x')</script>123"	"<script>alert('x')</script>123"		"<script>alert('x')</script>123"
$clean

Key Moments - 2 Insights

Why does the validation fail even though the input has numbers?

Because ctype_digit checks if the entire string is digits only. The input has letters and symbols, so validation fails as shown in step 2 of the execution table.

What does sanitization do if validation fails?

Sanitization does not run if validation fails. The program stops and outputs 'Invalid input' as in step 3.

Visual Quiz - 3 Questions

Look at the execution table, what is the validation result at step 2?

A True

B Error

C False

D Not checked

💡 Hint

Check the 'Validation Result' column at step 2 in the execution table.

At which step does the program output 'Invalid input'?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look at the 'Output' column in the execution table to find when 'Invalid input' is printed.

If the input was "12345", what would be the sanitized value?

A "<script>12345</script>"

B "12345"

C ""

D "Invalid input"

💡 Hint

Sanitization with FILTER_SANITIZE_NUMBER_INT keeps digits only, see variable_tracker for $clean.

Concept Snapshot

Input validation checks if data matches expected format.
Sanitization cleans input to remove harmful parts.
Validate first, then sanitize.
Reject input if validation fails.
Use PHP functions like ctype_digit and filter_var.
Always protect your program from bad input.

Full Transcript

This example shows how PHP handles input validation and sanitization. First, the program receives input which may contain harmful code or unexpected characters. It uses ctype_digit to check if the input is only digits. If the check fails, the program stops and prints 'Invalid input'. If it passes, it sanitizes the input using filter_var with FILTER_SANITIZE_NUMBER_INT to keep only numbers. This process protects the program from bad or dangerous input by first validating format, then cleaning the data before use.

Practice

1. What is the main purpose of input validation in PHP?

easy

A. To check if the input data is correct and safe

B. To store data in a database

C. To display data on the screen

D. To create new variables automatically

Solution

1. Step 1: Understand input validation

   Input validation means checking if the data entered by a user meets certain rules and is safe to use.

2. Step 2: Identify the purpose

   The main goal is to ensure data is correct and safe before using it in the program.

3. Final Answer:

   To check if the input data is correct and safe -> Option A

4. Quick Check:

   Input validation = check correctness and safety [OK]

Hint: Validation means checking data correctness and safety [OK]

Common Mistakes:

• Confusing validation with data storage
• Thinking validation displays data
• Assuming validation creates variables

2. Which of the following is the correct syntax to sanitize an email input in PHP?

easy

A. $email = filter_var($_POST['email'], FILTER_SANITIZE_STRING);

B. $email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);

C. $email = filter_var($_POST['email'], FILTER_VALIDATE_INT);

D. $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);

Solution

1. Step 1: Understand sanitization vs validation

   Sanitization cleans data by removing unwanted characters, validation checks if data is valid.

2. Step 2: Identify correct filter for sanitizing email

   FILTER_SANITIZE_EMAIL removes illegal characters from email input.

3. Final Answer:

   $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL); -> Option D

4. Quick Check:

   Sanitize email = FILTER_SANITIZE_EMAIL [OK]

Hint: Sanitize email uses FILTER_SANITIZE_EMAIL in filter_var() [OK]

Common Mistakes:

• Using FILTER_VALIDATE_EMAIL for sanitization
• Using FILTER_VALIDATE_INT for email
• Using FILTER_SANITIZE_STRING for email

3. What will be the output of this PHP code?

$input = "";
$clean = filter_var($input, FILTER_SANITIZE_STRING);
echo $clean;

medium

A. alert('Hi');</script>

B. <script>alert('Hi');</script>

C. alert('Hi');

D. Syntax error

Solution

1. Step 1: Understand FILTER_SANITIZE_STRING behavior

   This filter removes tags and encodes or strips HTML tags from the string.

2. Step 2: Apply filter to input

   The input contains a script tag; sanitizing removes the <script> and </script> tags, leaving only "alert('Hi');".

3. Final Answer:

   alert('Hi'); -> Option C

4. Quick Check:

   Sanitize string removes tags = alert('Hi'); [OK]

Hint: FILTER_SANITIZE_STRING removes HTML tags from input [OK]

Common Mistakes:

• Expecting tags to remain
• Confusing sanitization with validation
• Thinking code runs or causes error

4. Identify the error in this PHP code snippet for validating an integer input:

$age = $_POST['age'];
if (filter_var($age, FILTER_SANITIZE_INT)) {
    echo "Valid age";
} else {
    echo "Invalid age";
}

medium

A. Missing semicolon after echo statements

B. FILTER_SANITIZE_INT should be FILTER_VALIDATE_INT

C. Using $_POST without quotes

D. filter_var() cannot validate integers

Solution

1. Step 1: Understand difference between sanitize and validate

   FILTER_SANITIZE_INT cleans input by removing non-numeric characters but does not validate if input is a valid integer.

2. Step 2: Correct filter for validation

   To check if input is a valid integer, use FILTER_VALIDATE_INT instead of FILTER_SANITIZE_INT.

3. Final Answer:

   FILTER_SANITIZE_INT should be FILTER_VALIDATE_INT -> Option B

4. Quick Check:

   Validation needs FILTER_VALIDATE_INT, not sanitize [OK]

Hint: Use FILTER_VALIDATE_INT to check integers, not sanitize [OK]

Common Mistakes:

• Confusing sanitize with validate filters
• Ignoring filter_var() return values
• Assuming sanitize validates input

5. You want to accept a username that only contains letters, numbers, and underscores. Which PHP code correctly validates this input using filter_var() and a custom pattern?

hard

A. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_REGEXP, ['options' => ['regexp' => '/^[a-zA-Z0-9_]+$/']])) {
echo "Valid username";
} else {
echo "Invalid username";
}

B. $username = $_POST['username'];
if (filter_var($username, FILTER_SANITIZE_STRING)) {
echo "Valid username";
} else {
echo "Invalid username";
}

C. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_EMAIL)) {
echo "Valid username";
} else {
echo "Invalid username";
}

D. $username = $_POST['username'];
if (filter_var($username, FILTER_VALIDATE_INT)) {
echo "Valid username";
} else {
echo "Invalid username";
}

Solution

1. Step 1: Understand the requirement

   The username must only have letters, numbers, and underscores, so a regular expression is needed to check this pattern.

2. Step 2: Use FILTER_VALIDATE_REGEXP with correct pattern

   FILTER_VALIDATE_REGEXP allows validating input against a regex pattern. The pattern '/^[a-zA-Z0-9_]+$/' matches only allowed characters.

3. Step 3: Eliminate distractors

   The incorrect options use filters for integer validation, string sanitization, or email validation, none of which enforce the specific pattern of letters, numbers, and underscores.

4. Final Answer:

   Code using FILTER_VALIDATE_REGEXP with pattern '/^[a-zA-Z0-9_]+$/' -> Option A

5. Quick Check:

   Validate username with FILTER_VALIDATE_REGEXP + regex [OK]

Hint: Use FILTER_VALIDATE_REGEXP with regex for custom pattern validation [OK]

Common Mistakes:

• Using sanitize instead of validate
• Using email or int filters for username
• Not using regex for pattern matching