PHP Santizing/Validating Array of Integers

Question

I have the following array and would like to know what the best way would be of validating and santizing this array to make sure only integers are allowed?

if(is_array($_POST['taxonomy'])) {
    $term_ids = array_map('esc_attr', $_POST['taxonomy']);
}

Which looks like this when printed:

Array
(
    [0] => 13
    [1] => 12
)

I know the esc_attr isn't very secure so would like something a bit more beefed up.

Any help would be great.

Cheers,

Dave

If it was a string I'd just use (int) but is there something similar to use for an array? Thanks for your reply — daveaspinall
– daveaspinall, Commented Oct 7, 2011 at 7:50

deceze · Accepted Answer · 2011-10-07 07:50:02Z

16

Since it's $_POST data, you'll want to check for ctype_digit (i.e. a string containing only digits):

$sanitizedValues = array_filter($_POST['taxonomy'], 'ctype_digit');

Note that this simply discards non-numeric values.

answered Oct 7, 2011 at 7:50

deceze♦

525k89 gold badges806 silver badges954 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

daveaspinall Over a year ago

just tried this and it seems to be working spot on, thanks for everyone elses comments by the way, very helpful! How secure is this though? If someone were to inject something into this array? (We've had a few issues with hacking hence I'm going through all the code and plugging any holes). Cheers

deceze Over a year ago

With this you can be sure that $sanitizedValues contains only strings that contain only numbers. Nothing more, nothing less.

daveaspinall Over a year ago

Very nice, and very clean. Cheers @deceze and everyone else who posted a reply.

MikeSchinkel Over a year ago

Nice. Exactly what I was looking for. Kudos.

Yoshi · Accepted Answer · 2011-10-07 08:01:49Z

7

An alternative would be using phps filter functions:

$array = array(
  13, 12, '1', 'a'
);

$result = filter_var($array, FILTER_VALIDATE_INT, array(
  'flags'   => FILTER_REQUIRE_ARRAY,
  'options' => array('min_range' => 1)
));

var_dump($result);

/*
array(4) {
  [0]=>
  int(13)
  [1]=>
  int(12)
  [2]=>
  int(1)
  [3]=>
  bool(false)
}
*/

answered Oct 7, 2011 at 8:01

Yoshi

54.8k14 gold badges93 silver badges108 bronze badges

4 Comments

deceze Over a year ago

Much more verbose but technically more appropriate. +1 :)

daveaspinall Over a year ago

Sorry guys, whats the difference between the two?

Yoshi Over a year ago

If it's a single field you're validating, I think it's just a matter of taste. Although if you have a lot of validating the filter functions can save you some work (see filter_input_array for example). And I guess, if you or someone else has to understand what you're doing 3months later, the filter function do more clearly show whats happening.

daveaspinall Over a year ago

At the moment its just a single input. I've checked out the filter_input_array and it looks like its going to be very useful! I'll +1 this answer also, thanks alot @Yoshi for your help and advice. Every day's a school day :-)

Andrius Virbičianskas · Accepted Answer · 2011-10-07 07:51:16Z

1

if(is_array($_POST['taxonomy'])) {
    $term_ids = array_map('intval', $_POST['taxonomy']);
}

Should do the trick. NOTE: this is sanitation. More: http://php.net/manual/en/function.intval.php

answered Oct 7, 2011 at 7:51

Andrius Virbičianskas

5563 silver badges5 bronze badges

Comments

Tobias · Accepted Answer · 2011-10-07 07:58:34Z

1

foreach( $array as $key => $value) {
    $array[$key] = (int) $value;

    if( $array[$key] != $value ) {
        // error
    }
}

edited Oct 7, 2011 at 7:58

answered Oct 7, 2011 at 7:49

Tobias

9,4203 gold badges27 silver badges30 bronze badges

3 Comments

deceze Over a year ago

POST data is never int, it's all strings.

Tobias Over a year ago

This looks like numbers: Array ( [0] => 13 [1] => 12 )

deceze Over a year ago

Yes, but they're strings, not ints.

Minwork · Accepted Answer · 2020-01-24 16:32:30Z

0

If you are looking for one-liner to check against specified condition you can use:

$onlyIntegers = Arr::check($_POST['taxonomy'], 'ctype_digit');

assuming your $_POST['taxonomy'] can contain numeric strings as @deceze suggested, or just plain:

$onlyIntegers = Arr::check($_POST['taxonomy'], 'is_int');

if you are sure that $_POST['taxonomy'] values should be in fact integers.

Arr::check method is a part of this php array library which contains various methods to help you deal with different types of arrays.

answered Jan 24, 2020 at 16:32

Minwork

1,07211 silver badges10 bronze badges

Collectives™ on Stack Overflow

PHP Santizing/Validating Array of Integers

5 Answers 5

4 Comments

4 Comments

Comments

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

4 Comments

4 Comments

Comments

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related