PHP filter_input validate and sanitize

Question

I'm coding a contact form and I want to validate and sanitize user input using filter_input The problem is that because I use it for every POST variable shall I do a validate then sanitize or what? my suggestion is as follows:

if (!filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL)) {
exit ();
} else {
$email  = $_POST['email'];
}

is this OK or I must re-sanitize the $_POST['email']

Thanks

What you're trying to achieve isn't really clear. Why are you sanitizing? For SQL injection? — Alex W
– Alex W, Commented Apr 12, 2014 at 23:29
maybe yes maybe no as I will choose then to store the messages in db or send them by email — medk
– medk, Commented Apr 12, 2014 at 23:32
(2 years later) You can use filter_has_var() to check if the post is set. — Ron van der Heijden
– Ron van der Heijden, Commented Jul 9, 2014 at 13:35

nicowernli · Accepted Answer · 2014-04-12 23:24:25Z

4

Try this:

if ( !$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL)) {
    exit();
}

echo $email

answered Apr 12, 2014 at 23:24

nicowernli

3,34826 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Anthony Rutledge · Accepted Answer · 2016-01-10 06:41:57Z

0

I think using FILTER_SANITIZE_EMAIL before using FILTER_VALIDATE_EMAIL would be better. Also, I would suggest making a regular expression that forced email addresses to conform to what you want to accept for an email address. Both FILTER_SANITIZE_EMAIL and FILTER_VALIDATE_EMAIL are very liberal in the characters they will accept (the RFC allows more kinds of characters than you might want to allow, and in places you might not care to see them in).

answered Jan 10, 2016 at 6:41

Anthony Rutledge

7,7742 gold badges42 silver badges46 bronze badges

Collectives™ on Stack Overflow

PHP filter_input validate and sanitize

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related