Is there an advantage to using filter_input instead of isset?

Question

I’ve always been used to using the isset to check if an external variable is filled and if you are using it.

Example:

if(isset($_GET['pag']))
     $pag = $_GET['pag'];

Now I installed the Netbeans and give me a Warning telling to use the function filter_input.

Example:

if($pag = filter_input(INPUT_GET , 'pag'));

Is there any advantage in using the function filter_input?

Answer 1

How it can be read in the function documentation filter_input ^(English):

filter_input - Gets a specific External variable by name and Optionally Filters it

That translated:

filter_input - Fetches a specific external variable by name and optionally filters its value.

The advantage in using the function filter_input is the fact that we will not only collect the value we can also in the course of this collection filter the same:

$search_html = filter_input(INPUT_GET, 'chavePesquisa', FILTER_SANITIZE_SPECIAL_CHARS);

Useful for protecting, cleaning or validating user data without using multiple functions and multiple lines of code.

The filter list can be found here:

PHP Manual > Function Reference > Variable and Type Related Extensions > Filter ^(English)

Answer 2

The main difference is that isset() checks if there is any value in the variable, while with filter_input() it is possible to do some validations or cleanups on the inputs.

the list of validations and cleanups

The use of filter_input() can sometimes simplify validations, for example an age interval, where a child would not pay a bus ticket, or would have a differentiated value in the charge of a meal in a restaurant.

Validation with filter_input:

$options = array('options' => array('min_range' => 0, 'max_range' => 6 ));
if($idade = filter_input(INPUT_GET, 'search', FILTER_VALIDATE_INT, $options)){
    echo 'isento de pagar a passagem de ônibus pois sua idade é: '. $idade;
}else{
    echo 'Na dúvida sempre cobre, idade: '. $idade;
}

A traditional form of validation:

$idade = -1;
if(isset($_GET['search']) && ctype_digit($_GET['search'])){
    $idade = $_GET['search'];
}

if($idade >= 0 && $idade <= 6){
    echo 'Isento de pagar a passagem de ônibus pois sua idade é: '. $idade;
}else{
    echo 'Na dúvida sempre cobre, idade: '. $idade;
}

Answer 3

One thing I don’t think anyone has commented on, but I think it’s important to point out is that filter_input has a big difference from the isset.

The isset will check whether a particular one is existing, regardless of whether it comes from external content or not.

Common example:

// url?nome=wallace 
isset($_GET['nome']); // true

But if I do this, it will work too:

// url?nome=wallace
 $_GET['idade'] = 25;
isset($_GET['idade']); // true

Note that I declared a value for variable $_GET, which did not exist in the url, but only in the code, and isset detected him there, as was to be expected.

Now look at the difference between filter_input

//url?nome=wallace
filter_input(INPUT_GET, 'nome'); // 'wallace';

In that case:

$_GET['idade'] = 25;
filter_input(INPUT_GET, 'idade');// bool(false)

Realize that filter_input is not "misled" by the declaration of a value within the array $_GET.

So, filter_input really checks if the content exists externally, via GET method. Now isset only checks whether the value exists or not.

The same case applies to the function filter_has_var. So, here’s a reason to use it instead of isset;

I thought it important to emphasize this here.

Answer 4

The advantage in using the filter_input is in the facility to apply filters to your string.

The same result can be obtained with the function filter_var, implementing the constants of FILTER

The filter_input would have the same function as:

// Sem filter_input
$email = filter_var($_GET['email'], FILTER_VALIDATE_EMAIL);

// Usando filter input
$email = filter_input(INPUT_GET , 'email', FILTER_VALIDATE_EMAIL);

The functions filter_* are few used by beginners, but they are quite useful. In the example above for example, php already validates if the input is an email, without having to resort to Monstrous Regular Expressions.

With a little creativity, using a prime of the function filter_input, to filter_input_array, we can validate our forms with a very expressive and elegant code.

---

Adapted example of the documentation:

<?php

$data = array(
    'product_id'    => 'libgd<script>',
    'component'     => '10',
    'versions'      => '2.0.33',
    'testscalar'    => array('2', '23', '10', '12'),
    'testarray'     => '2',
);

$args = array(
    'product_id'   => FILTER_SANITIZE_ENCODED,
    'component'    => array('filter'    => FILTER_VALIDATE_INT,
                            'flags'     => FILTER_FORCE_ARRAY,
                            'options'   => array('min_range' => 1, 'max_range' => 10)
                           ),
    'versions'     => FILTER_SANITIZE_ENCODED,
    'doesnotexist' => FILTER_VALIDATE_INT,
    'testscalar'   => array(
                            'filter' => FILTER_VALIDATE_INT,
                            'flags'  => FILTER_REQUIRE_SCALAR,
                           ),
    'testarray'    => array(
                            'filter' => FILTER_VALIDATE_INT,
                            'flags'  => FILTER_FORCE_ARRAY,
                           )

);

$myinputs = filter_var_array($data, $args);

var_dump($myinputs);

Results in the following array already treated:

array(6) {
  ["product_id"]=>
  array(1) {
    [0]=>
    string(17) "libgd%3Cscript%3E"
  }
  ["component"]=>
  array(1) {
    [0]=>
    int(10)
  }
  ["versions"]=>
  array(1) {
    [0]=>
    string(6) "2.0.33"
  }
  ["doesnotexist"]=>
  NULL
  ["testscalar"]=>
  bool(false)
  ["testarray"]=>
  array(1) {
    [0]=>
    int(2)
  }
}

Answer 5

Yes, and a lot of advantage, since with it you "clean" the input data when using the third parameter, which is the filter type. There are several filters that you can replace with manual validations that you used to do, such as validating an email address or simply checking if an entry is a number.

Some examples:

if ($email = filter_input(INPUT_POST , 'email', FILTER_VALIDATE_EMAIL)) {
    // é um e-mail válido
}

if ($numero = filter_input(INPUT_POST , 'numero', FILTER_VALIDATE_INT)) {
    // é um inteiro
}

Filters, as you can check in the above URL, can be either for validation or to "sanitize" an input.

Remembering that it is available from the version 5.2.0.

Answer 6

There is a bug (reported on 24/03/2012) related to the function filter_input(). Some values of $_SERVER are not displayed correctly. The code snippet below displays the keys where the problem occurs:

foreach ($_SERVER as $key => $value) {
    if (filter_input(INPUT_SERVER, $key) != $value) {
        echo $key;
    }
}

Keys will be displayed REQUEST_TIME and REQUEST_TIME_FLOAT. These two cases should not be used filter_input(), using "traditional" access with:

$_SERVER['REQUEST_TIME'];

The function filter_has_var() is also affected by this bug.