PHP Security - (int) vs FILTER_VALIDATE_INT

Question

I recently was told there is FILTER_VALIDATE_INT which is great by the way.

My question is in terms of taking an integer value from the website whether it maybe from user or generated from the web application, and passed via query string.

The value (integer) may be displayed or used in mysql query.

I am trying to structure the best possible security method for this.

With that in mind, is it safe to simply use

$myNum = (int)$_GET['num'];

Or

if (filter_var($_GET['num'], FILTER_VALIDATE_INT)) $myNum = $_GET['num'];

Also, please explain what is the difference between using (int) and FILTER_VALIDATE_INT

To expand on the existing answers, FILTER_SANITIZE_NUMBER_INT is equivalent to (int) casting. — mario
– mario, Commented Jan 25, 2011 at 3:31
Here is a fun note, FILTER_VALIDATE_INT says '0011' is not an int but '1111' is an int. The more you know... — sousdev
– sousdev, Commented Apr 11, 2018 at 22:32

deceze · Accepted Answer · 2019-02-21 19:12:24Z

33

The difference is that a cast to int will always get you an int, which may or may not be the original value. E.g. (int)'foobar' results in the int 0. This makes it safe for most SQL purposes, but has nothing to do with the original value, and you won't even know it.

filter_var with FILTER_VALIDATE_INT tells you whether the value is an int, based on which you can make the decision to use it in an SQL query or display an error message to the user.

edited Feb 21, 2019 at 19:12

answered Jan 25, 2011 at 3:14

deceze♦

525k89 gold badges806 silver badges954 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

Russell Dias Over a year ago

@deceze would you happen to know if there is much of a difference between filter_var and its is_int counterpart?

zerkms Over a year ago

@Russell Dias: results for '42' at least (integer represented as string).

Russell Dias Over a year ago

@zerkms Oops didn't realize it tests a numeric string too. Thanks for the example ;)

Adil Over a year ago

Got it. It makes sense now. Thanks!

Anthony Rutledge Over a year ago

@deceze It appears that FILTER_VALIDATE_INT also works with strings submitted from forms, so it works a little bit differently than you described.

|

zloctb · Accepted Answer · 2015-10-22 14:27:20Z

0

 <input type="text" name="param"></input>


$price = filter_input(INPUT_POST, 'param', FILTER_VALIDATE_INT);
if ($price !== false) {
print " a number.";    //works when value is number
}


if(is_int($_POST['param'])){
    print "is number."; //don't works when value is number
}

Please try test with when value is number .

answered Oct 22, 2015 at 14:27

zloctb

11.3k10 gold badges78 silver badges92 bronze badges

Collectives™ on Stack Overflow

PHP Security - (int) vs FILTER_VALIDATE_INT

2 Answers 2

8 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

8 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related