Input validation vs sanitization in PHP - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to check if the input is a valid email.

PHP

<?php
$email = $_POST['email'];
if (filter_var($email, [1])) {
    echo "Valid email.";
} else {
    echo "Invalid email.";
}
?>

Drag options to blanks, or click blank then click option'

AFILTER_VALIDATE_INT

BFILTER_SANITIZE_EMAIL

CFILTER_VALIDATE_EMAIL

DFILTER_SANITIZE_STRING

Attempts:

3 left

💡 Hint

Common Mistakes

Using FILTER_SANITIZE_EMAIL instead of FILTER_VALIDATE_EMAIL for validation.

Use FILTER_VALIDATE_EMAIL to check if the input is a valid email format.

2fill in blank

medium

Complete the code to sanitize the input by removing illegal characters from an email.

PHP

<?php
$email = $_POST['email'];
$clean_email = filter_var($email, [1]);
echo $clean_email;
?>

Drag options to blanks, or click blank then click option'

AFILTER_SANITIZE_EMAIL

BFILTER_SANITIZE_STRING

CFILTER_VALIDATE_EMAIL

DFILTER_VALIDATE_URL

Attempts:

3 left

💡 Hint

Common Mistakes

Using FILTER_VALIDATE_EMAIL when sanitization is needed.

Use FILTER_SANITIZE_EMAIL to remove illegal characters from the email input.

3fill in blank

hard

Fix the error in the code to properly validate an integer input.

PHP

<?php
$age = $_POST['age'];
if (filter_var($age, [1])) {
    echo "Valid age.";
} else {
    echo "Invalid age.";
}
?>

Drag options to blanks, or click blank then click option'

AFILTER_SANITIZE_NUMBER_INT

BFILTER_VALIDATE_INT

CFILTER_VALIDATE_EMAIL

DFILTER_SANITIZE_STRING

Attempts:

3 left

💡 Hint

Common Mistakes

Using FILTER_SANITIZE_NUMBER_INT instead of FILTER_VALIDATE_INT for validation.

Use FILTER_VALIDATE_INT to check if the input is a valid integer.

4fill in blank

hard

Fill both blanks to create a sanitized and validated username input.

PHP

<?php
$username = $_POST['username'];
$clean_username = filter_var($username, [1]);
if (preg_match([2], $clean_username)) {
    echo "Valid username.";
} else {
    echo "Invalid username.";
}
?>

Drag options to blanks, or click blank then click option'

AFILTER_SANITIZE_STRING

B/^[a-zA-Z0-9_]{3,20}$/

C/^[\w]{3,20}$/

DFILTER_VALIDATE_EMAIL

Attempts:

3 left

💡 Hint

Common Mistakes

Using FILTER_VALIDATE_EMAIL for username validation.

Not sanitizing before validating.

First sanitize the username to remove unwanted characters using FILTER_SANITIZE_STRING. Then validate it with a regular expression that allows letters, numbers, and underscores between 3 and 20 characters.

5fill in blank

hard

Fill all three blanks to sanitize and validate a URL input.

PHP

<?php
$url = $_POST['url'];
$clean_url = filter_var($url, [1]);
if (filter_var($clean_url, [2]) && preg_match([3], $clean_url)) {
    echo "Valid URL.";
} else {
    echo "Invalid URL.";
}
?>

Drag options to blanks, or click blank then click option'

AFILTER_SANITIZE_URL

BFILTER_VALIDATE_URL

C/^https?:\/\//

DFILTER_SANITIZE_STRING

Attempts:

3 left

💡 Hint

Common Mistakes

Skipping sanitization before validation.

Not checking the URL scheme with regex.

Sanitize the URL first with FILTER_SANITIZE_URL. Then validate it with FILTER_VALIDATE_URL. Finally, use a regex to ensure it starts with http or https.

Practice

1. What is the main purpose of input validation in PHP?

easy

A. To remove unwanted characters from the input

B. To store input data in a database

C. To check if the input data meets expected rules or format

D. To encrypt the input data for security

Solution

1. Step 1: Understand input validation meaning

   Input validation means checking if the data entered by the user follows the expected format or rules, like checking if an email looks like an email.

2. Step 2: Compare with other options

   Removing unwanted characters is sanitization, storing data is unrelated, and encrypting is a different security step.

3. Final Answer:

   To check if the input data meets expected rules or format -> Option C

4. Quick Check:

   Validation = Check input format [OK]

Hint: Validation means checking input correctness, not cleaning it [OK]

Common Mistakes:

• Confusing validation with sanitization
• Thinking validation changes the input
• Assuming validation stores or encrypts data

2. Which PHP function is used primarily for sanitizing an email input?

easy

A. filter_var($email, FILTER_VALIDATE_EMAIL)

B. trim($email)

C. htmlspecialchars($email)

D. filter_var($email, FILTER_SANITIZE_EMAIL)

Solution

1. Step 1: Identify sanitization function for email

   FILTER_SANITIZE_EMAIL removes illegal characters from an email string, cleaning it.

2. Step 2: Differentiate from validation and other functions

   FILTER_VALIDATE_EMAIL checks if email is valid (validation). htmlspecialchars escapes HTML, trim removes spaces.

3. Final Answer:

   filter_var($email, FILTER_SANITIZE_EMAIL) -> Option D

4. Quick Check:

   Sanitize email = FILTER_SANITIZE_EMAIL [OK]

Hint: Sanitize email uses FILTER_SANITIZE_EMAIL, not VALIDATE [OK]

Common Mistakes:

• Using FILTER_VALIDATE_EMAIL for sanitization
• Confusing htmlspecialchars with sanitization
• Ignoring trimming spaces as sanitization

3. What will be the output of this PHP code?

$input = "[e-mail]";
$sanitized = filter_var($input, FILTER_SANITIZE_EMAIL);
echo $sanitized;

medium

A. alert('Hi');[e-mail]

B. [e-mail]

C. <script>alert('Hi');</script>[e-mail]

D. Syntax error

Solution

1. Step 1: Understand FILTER_SANITIZE_EMAIL effect

   This filter removes illegal characters but keeps some like apostrophes and semicolons, so the alert part remains partially.

2. Step 2: Analyze input and output

   The <script> tags are removed, but alert('Hi'); remains before the email, so output is alert('Hi');[e-mail].

3. Final Answer:

   alert('Hi');[e-mail] -> Option A

4. Quick Check:

   Sanitize email removes tags but keeps some chars [OK]

Hint: Sanitize email removes tags but may keep some symbols [OK]

Common Mistakes:

• Expecting full removal of script content
• Confusing sanitization with escaping HTML
• Assuming syntax error from special chars

4. Identify the error in this PHP code snippet for validating an integer input:

$age = "25";
if (filter_var($age, FILTER_SANITIZE_NUMBER_INT)) {
  echo "Valid age";
} else {
  echo "Invalid age";
}

medium

A. Using FILTER_SANITIZE_NUMBER_INT instead of FILTER_VALIDATE_INT

B. Missing semicolon after echo statements

C. Incorrect variable name in filter_var

D. No error, code is correct

Solution

1. Step 1: Check filter used for validation

   FILTER_SANITIZE_NUMBER_INT cleans input but does not validate if it's a proper integer.

2. Step 2: Correct filter for validation

   FILTER_VALIDATE_INT should be used to check if input is a valid integer.

3. Final Answer:

   Using FILTER_SANITIZE_NUMBER_INT instead of FILTER_VALIDATE_INT -> Option A

4. Quick Check:

   Validation needs FILTER_VALIDATE_INT, not sanitize [OK]

Hint: Validation uses FILTER_VALIDATE_INT, not sanitize filters [OK]

Common Mistakes:

• Confusing sanitize and validate filters
• Ignoring filter_var second argument importance
• Assuming sanitize also validates

5. You want to accept a username input that must be alphanumeric and between 5 to 10 characters. Which approach correctly combines validation and sanitization in PHP?

hard

A. Validate with FILTER_VALIDATE_REGEXP for pattern, then sanitize with FILTER_SANITIZE_STRING

B. Sanitize with FILTER_SANITIZE_STRING, then validate length and ctype_alnum

C. Only sanitize with FILTER_SANITIZE_STRING, no validation needed

D. Only validate length with strlen, ignore sanitization

Solution

1. Step 1: Understand validation and sanitization order

   First sanitize the input to remove unwanted characters using FILTER_SANITIZE_STRING.

2. Step 2: Validate length and alphanumeric

   Then validate the length with strlen and check if the string is alphanumeric using ctype_alnum.

3. Final Answer:

   Sanitize with FILTER_SANITIZE_STRING, then validate length and ctype_alnum -> Option B

4. Quick Check:

   Sanitize first, then validate pattern and length [OK]

Hint: Sanitize first, then validate length and alphanumeric [OK]

Common Mistakes:

• Validating before sanitizing
• Skipping sanitization and trusting validation only
• Ignoring length check in validation