What is the difference between `filter_var`and `filter_input`?

Asked

Viewed 1,009 times

6

What’s the difference between filter_var and filter_input? I can’t find it anywhere, at least not in a way I understand.

And how can I replace mysql_real_escape_string by one of them?

$password = mysql_real_string($_POST['password']);
php mysql validation

1 answer

8


Filter_input and filter_var functions:

The basic difference is that the filter_input plays the role of filter_var, but already picking from an input variable (such as GET or POST).

This code right here...

$email = $_POST['email'];
$resultado = filter_var( $email, FILTER_VALIDATE_EMAIL );

does the same thing as this:

$resultado = filter_input( INPUT_POST, 'email', FILTER_VALIDATE_EMAIL );

For available filters, see the PHP manual: Filter types


Function mysql_real_escape_string:

The mysql_real_escape_string() is for something completely different: it is to sanitize the data for entry into Mysql table fields. Its purpose is more specific, but it is an obsolete function, just like all the library’s mysql_.

To replace the latter, use for example the library mysqli, see this issue here.


In short:

  • If you want to filter an existing variable, use filter_var;

  • if filtering a GET or POST, for example, use the filter_input;

  • if you are going to filter a value to insert into Mysql change the Mysql library mysql_real_escape_string for mysqli_ with bind Parameters.

filter_input and filter_var are not substitutes for mysql_real_escape_string.

  • For a Login page, Filter_input would be more appropriate?

  • 1

    @Lukaz11 If you are going to use the variable in a query (SELECT or INSERT something), it must bemysqli_ or mysql_real_escape_string. If you are going to use it to validate an email for something else (display on page), it can be filter_(input or var,. then the most appropriate one depends on where the variable comes from). Nothing prevents you from using the filter to validate the email in PHP, and then usingmysqli_ to store it correctly. It depends a lot on your code. Take a look at the link I put on bind Parameters that there is an answer that explains how to use mysqli.

Browser other questions tagged php mysql validation

You are not signed in. Login or sign up in order to post.