Input validation vs sanitization in PHP - Practice Questions

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP code snippet?

Consider the following PHP code that tries to validate and sanitize user input. What will it output?

PHP

<?php
$input = "<script>alert('XSS');</script>";
$validated = filter_var($input, FILTER_VALIDATE_EMAIL);
$sanitized = filter_var($input, FILTER_SANITIZE_EMAIL);
echo "Validated: ";
var_export($validated);
echo "\nSanitized: ";
var_export($sanitized);
?>

A

Validated: false
Sanitized: "scriptalertXSSscript"

B

Validated: "<script>alert('XSS');</script>"
Sanitized: "<script>alert('XSS');</script>"

C

Validated: false
Sanitized: "alert('XSS')"

D

Validated: null
Sanitized: "alert('XSS')"

💡 Hint

FILTER_VALIDATE_EMAIL returns false if input is not a valid email. FILTER_SANITIZE_EMAIL removes invalid characters.

The input is not a valid email, so validation returns false. Sanitization removes characters invalid in emails, leaving 'scriptalertXSSscript'.

🧠 Conceptual

intermediate

Which statement correctly describes input validation vs sanitization?

Choose the option that best explains the difference between input validation and input sanitization.

A Validation checks if input meets criteria; sanitization modifies input to remove harmful parts.

B Validation modifies input to remove harmful parts; sanitization checks if input meets criteria.

C Validation encrypts input; sanitization decrypts input.

D Validation stores input securely; sanitization deletes input.

💡 Hint

Think about whether the process changes the input or just checks it.

Validation is about checking if input is acceptable. Sanitization changes input to make it safe.

🔧 Debug

advanced

Why does this PHP code fail to prevent XSS?

This PHP code tries to sanitize user input to prevent XSS attacks. Why does it fail?

PHP

<?php
$user_input = "<img src=x onerror=alert(1) />";
$safe_input = filter_var($user_input, FILTER_SANITIZE_STRING);
echo $safe_input;
?>

A The code should use FILTER_VALIDATE_URL instead.

B filter_var does not exist in PHP.

C FILTER_SANITIZE_STRING does not exist and does not remove all harmful attributes like onerror.

D echo cannot output sanitized strings.

💡 Hint

Check PHP documentation about FILTER_SANITIZE_STRING.

FILTER_SANITIZE_STRING was deprecated as of PHP 8.1 and removed in PHP 8.3, and it does not remove dangerous HTML attributes like onerror, so XSS can still happen.

📝 Syntax

advanced

Which PHP code snippet correctly validates and sanitizes an email input?

Select the code that first validates an email input and then sanitizes it if valid.

A

<?php
$email = "[e-mail]";
$clean = filter_var($email, FILTER_VALIDATE_EMAIL);
if ($clean) {
  echo filter_var($email, FILTER_SANITIZE_EMAIL);
}
?>

B

<?php
$email = "[e-mail]";
$clean = filter_var($email, FILTER_SANITIZE_EMAIL);
if (filter_var($clean, FILTER_VALIDATE_EMAIL)) {
  echo $clean;
}
?>

C

<?php
$email = "[e-mail]";
if (filter_var($email, FILTER_SANITIZE_EMAIL)) {
  $clean = filter_var($email, FILTER_VALIDATE_EMAIL);
  echo $clean;
}
?>

D

<?php
$email = "[e-mail]";
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
  $clean = filter_var($email, FILTER_SANITIZE_EMAIL);
  echo $clean;
}
?>

💡 Hint

Validation should happen before sanitization to confirm input is valid.

Option D validates first, then sanitizes. Option D sanitizes first which may alter input before validation. Option D uses wrong filter in if condition. Option D sanitizes after validation but echoes original input sanitized again.

🚀 Application

expert

How many items are in the resulting array after this PHP input processing?

Given this PHP code that validates and sanitizes an array of user inputs, how many items remain in the final array?

PHP

<?php
$inputs = ["[e-mail]", "invalid-email", "[e-mail]", "<b>[e-mail]</b>"];
$valid_emails = array_filter($inputs, fn($email) => filter_var($email, FILTER_VALIDATE_EMAIL));
$sanitized_emails = array_map(fn($email) => filter_var($email, FILTER_SANITIZE_EMAIL), $valid_emails);
print_r($sanitized_emails);
?>

A 1

B 2

C 3

D 4

💡 Hint

Count how many inputs pass FILTER_VALIDATE_EMAIL before sanitization.

Only "[e-mail]" and "[e-mail]" are valid emails. "invalid-email" fails validation. "[e-mail]" fails validation because of tags. So 2 items remain.