PHP filter_var(): Validate Email, Int, URL and More

filter_var($value, FILTER_VALIDATE_EMAIL) returns the value when it is a valid email address and false when it is not. Swap the filter to check other formats: FILTER_VALIDATE_INT, FILTER_VALIDATE_FLOAT, FILTER_VALIDATE_URL, FILTER_VALIDATE_BOOL, FILTER_VALIDATE_IP. Always compare the result with === false.

<?php
$emails = ['ada@example.com', 'ada.lovelace+news@example.co.uk', 'ada@', 'ada@example', 'ada..x@example.com', ' ada@example.com'];

foreach ($emails as $email) {
    $ok = filter_var($email, FILTER_VALIDATE_EMAIL) !== false;
    printf("%-34s %s\n", "'$email'", $ok ? 'valid' : 'invalid');
}

Two results surprise people. ada@example is rejected because the domain has no dot, and ' ada@example.com' is rejected because of the leading space, so trim() input before you validate it.

Validate an email from a form

The same check behind a form. Run it, type an address and press Check; the block runs again with your input in $_POST.

<?php
$email = trim((string) ($_POST['email'] ?? ''));
$result = '';

if ($email !== '') {
    $result = filter_var($email, FILTER_VALIDATE_EMAIL) !== false
        ? '<b style="color:#2e7d32">valid</b>'
        : '<b style="color:#c62828">invalid</b>';
}
?>
<form method="post">
  <input name="email" size="30" value="<?= htmlspecialchars($email) ?>" placeholder="you@example.com">
  <button>Check</button>
</form>
<?php if ($result): ?><p><?= htmlspecialchars($email) ?> is <?= $result ?></p><?php endif; ?>

FILTER_VALIDATE_EMAIL checks the format only. nobody@example.com passes, and so would an address with a typo in the domain. Non-ASCII characters are rejected: adä@example.com passes only with FILTER_FLAG_EMAIL_UNICODE, which allows them before the @, and a domain like exämple.com fails even with the flag unless you convert it to its xn-- form first. The only way to know an address works is to send it a confirmation link.

Validate an integer, with min_range and max_range

FILTER_VALIDATE_INT turns a valid string into an int and rejects everything else. The options array adds a range and a default:

<?php
$inputs = ['42', '-7', ' 42 ', '+42', '4.2', '042', '42abc', '', '0'];

foreach ($inputs as $in) {
    echo str_pad("'$in'", 8), ' => ';
    var_dump(filter_var($in, FILTER_VALIDATE_INT));
}

$age = filter_var('150', FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 0, 'max_range' => 120],
]);
var_dump($age);

$page = filter_var('abc', FILTER_VALIDATE_INT, ['options' => ['default' => 1]]);
var_dump($page);

Surrounding whitespace and a leading + are accepted, a leading zero ('042') is not, and the result for '42' is the integer 42, not the string. Out of range gives false; with a default option you get the default instead of false, which is handy for things like ?page= (see $_GET and$_POST). Add FILTER_FLAG_ALLOW_HEX or FILTER_FLAG_ALLOW_OCTAL to accept 0x1A or 0755.

The 0 and false trap

A valid '0' returns the integer 0, and 0 is falsy. A plain if treats it as a failure:

<?php
$quantity = '0';

if (filter_var($quantity, FILTER_VALIDATE_INT)) {
    echo "if (...): valid\n";
} else {
    echo "if (...): rejected, wrongly\n";
}

if (filter_var($quantity, FILTER_VALIDATE_INT) !== false) {
    echo "!== false: valid\n";
}

// Or get null instead of false on failure, and check for null
$n = filter_var('abc', FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
var_dump($n);

The same applies to FILTER_VALIDATE_FLOAT ('0.0') and FILTER_VALIDATE_BOOL, where false is a valid answer. That is what FILTER_NULL_ON_FAILURE is for.

Booleans, floats, URLs and IP addresses

<?php
// Booleans: "1", "true", "on", "yes" are true; "0", "false", "off", "no", "" are false
foreach (['yes', 'off', 'TRUE', 'maybe'] as $v) {
    echo str_pad($v, 6), ' => ', var_export(filter_var($v, FILTER_VALIDATE_BOOL, FILTER_NULL_ON_FAILURE), true), "\n";
}

// Floats: the decimal separator is "." unless you say otherwise
var_dump(filter_var('3.14', FILTER_VALIDATE_FLOAT));
var_dump(filter_var('3,14', FILTER_VALIDATE_FLOAT));
var_dump(filter_var('3,14', FILTER_VALIDATE_FLOAT, ['options' => ['decimal' => ',']]));
var_dump(filter_var('1,000.5', FILTER_VALIDATE_FLOAT, FILTER_FLAG_ALLOW_THOUSAND));

// URLs need a scheme
var_dump(filter_var('https://coddy.tech/docs?x=1', FILTER_VALIDATE_URL));
var_dump(filter_var('coddy.tech', FILTER_VALIDATE_URL));

// IP addresses, optionally excluding private ranges
var_dump(filter_var('192.168.1.10', FILTER_VALIDATE_IP));
var_dump(filter_var('192.168.1.10', FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE));

FILTER_VALIDATE_BOOL is the PHP 8 name; FILTER_VALIDATE_BOOLEAN is the same filter. Without FILTER_NULL_ON_FAILURE, 'maybe' would return false, indistinguishable from 'off'.

A valid URL is not a safe link

FILTER_VALIDATE_URL checks that the string is shaped like a URL, with any scheme. That includes schemes you never want in an href:

<?php
function isSafeLink(string $url): bool
{
    if (filter_var($url, FILTER_VALIDATE_URL) === false) {
        return false;
    }
    $scheme = strtolower((string) parse_url($url, PHP_URL_SCHEME));
    return in_array($scheme, ['http', 'https'], true);
}

foreach (['https://example.com', 'javascript://comment%0Aalert(1)', 'ftp://files.example.com', 'example.com'] as $url) {
    printf("%-36s filter_var: %-5s  safe link: %s\n",
        $url,
        filter_var($url, FILTER_VALIDATE_URL) !== false ? 'yes' : 'no',
        isSafeLink($url) ? 'yes' : 'no');
}

javascript://comment%0Aalert(1) passes FILTER_VALIDATE_URL, and a browser runs it as JavaScript when the link is clicked, because %0A ends the //comment. Check the scheme with parse_url() before you print a user's URL into a page. You can also require parts with FILTER_FLAG_PATH_REQUIRED and FILTER_FLAG_QUERY_REQUIRED.

Sanitize filters

Sanitize filters remove characters instead of saying yes or no. They are useful for normalizing input, not for making it safe to print:

<?php
var_dump(filter_var('Order #12-345 (x2)', FILTER_SANITIZE_NUMBER_INT));
var_dump(filter_var('$1,299.99', FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION));
var_dump(filter_var('ada (at) example.com', FILTER_SANITIZE_EMAIL));
var_dump(filter_var('<b>Tom</b> & "Jerry"', FILTER_SANITIZE_FULL_SPECIAL_CHARS));

Look at the first line: Order #12-345 (x2) becomes 12-3452, a number that was never in the input, and the third line is an address nobody typed. If you sanitize, validate the result afterwards. For anything you print into HTML, htmlspecialchars() at output time is the right tool (FILTER_SANITIZE_FULL_SPECIAL_CHARS does the same escaping). FILTER_SANITIZE_STRING is deprecated since PHP 8.1; see htmlspecialchars for what to use instead.

Validate a whole form with filter_var_array

filter_var_array() applies one filter per key and returns an array with every key you asked for: the filtered value, false when validation failed, or null when the key was missing.

<?php
$input = ['age' => '31', 'email' => 'not-an-email', 'newsletter' => 'on', 'role' => 'admin'];

$clean = filter_var_array($input, [
    'age'        => ['filter' => FILTER_VALIDATE_INT, 'options' => ['min_range' => 13]],
    'email'      => FILTER_VALIDATE_EMAIL,
    'newsletter' => ['filter' => FILTER_VALIDATE_BOOL, 'flags' => FILTER_NULL_ON_FAILURE],
    'country'    => FILTER_DEFAULT,
]);

var_dump($clean);

role is gone: keys you did not list are dropped, which stops a visitor from adding role=admin to a form and having it saved. country is null because it was not sent. On a web server, filter_input_array(INPUT_POST, $rules) does the same thing reading straight from the request.