Input validation vs sanitization in PHP - Quick Revision & Key Differences

Recall & Review

beginner

What is input validation?

Input validation is the process of checking if the data entered by a user meets certain rules before using it. It ensures the data is correct and safe to use.

beginner

What does input sanitization mean?

Input sanitization means cleaning or changing user data to remove harmful parts, like special characters, to make it safe for use.

intermediate

Why do we need both validation and sanitization?

Validation checks if data is correct and fits rules. Sanitization cleans data to prevent security problems. Using both helps keep programs safe and working well.

intermediate

Example: What happens if you validate but don't sanitize user input?

If you only validate, bad characters might still be in the input. This can cause security issues like code injection or broken pages.

beginner

In PHP, which function is used for sanitizing email input?

The PHP function filter_var($email, FILTER_SANITIZE_EMAIL) removes unwanted characters from an email address.

What is the main goal of input validation?

A To check if input data meets rules

B To remove harmful characters

C To store data in a database

D To display data on the screen

Input validation ensures the data entered fits expected rules before using it.

Which PHP function is used to sanitize a string by removing HTML tags?

A htmlspecialchars()

B strip_tags()

C filter_var() with FILTER_VALIDATE_STRING

D trim()

strip_tags() removes HTML and PHP tags from a string, sanitizing it.

What can happen if you skip sanitization but validate input?

A Data will always be safe

B Program will run faster

C Validation will fix harmful data

D Security risks like code injection may occur

Without sanitization, harmful characters can cause security problems even if data is valid.

Which is true about input sanitization?

A It cleans input to make it safe

B It stores input in a file

C It checks if input is correct

D It ignores user input

Sanitization cleans input data to remove or escape harmful parts.

Which PHP filter validates an email address?

A FILTER_SANITIZE_EMAIL

B FILTER_SANITIZE_STRING

C FILTER_VALIDATE_EMAIL

D FILTER_VALIDATE_INT

FILTER_VALIDATE_EMAIL checks if the input is a valid email format.

Explain the difference between input validation and input sanitization.

Think about checking vs cleaning user data.

Why is it important to use both validation and sanitization when handling user input in PHP?

Consider safety and correctness.