Input sanitization
Learn to sanitize and validate input with filter_input() and filter_var().
What does filter_input do?
filter_input(INPUT_GET, 'email', FILTER_VALIDATE_EMAIL) fetches external input, validates and cleans it. filter_var applies the same filter to a value you already hold. Validation filters like FILTER_VALIDATE_EMAIL and FILTER_VALIDATE_INT return false on a bad format.
Sanitization filters like FILTER_SANITIZE_STRING and FILTER_SANITIZE_SPECIAL_CHARS escape dangerous characters. Always check the result with === false; empty() gives false negatives (0 or "0" can be valid). Use filter_input for external sources, filter_var for values you already have.
Signed input with hash_hmac
Important inputs (order ID, callback URL) are signed with hash_hmac. You produce a HMAC with $mac = hash_hmac("sha256", $data, $key); the receiver recomputes with the same key and compares with hash_equals($mac, $expected).
hash_equals runs in constant time; it is always used instead of ==. The hash function works without a key; it produces a digest, not integrity. The key ($key) must stay secret on the server, never in a URL. Because HMAC detects tampering, input integrity is guaranteed.
Exercise Validate and sign with filter_var + hash_hmac
Define a filterAndSign($email, $key) function. Inside it, call filter_var($email, FILTER_VALIDATE_EMAIL); return an empty string if false. If true, compute $mac with hash_hmac("sha256", $email, $key) and return $mac. The $key is already defined. Call filterAndSign("user@example.com", $key) and filterAndSign("not-email", $key); print the strlen of each result.
Show example solution
Write function filterAndSign($email, $key) { if (filter_var($email, FILTER_VALIDATE_EMAIL) === false) { return ""; } return hash_hmac("sha256", $email, $key); }. "user@example.com" is valid → hash_hmac sha256 = 64 hex characters → strlen 64. "not-email" is invalid → empty string → strlen 0.
Example solution:
<?php
$key = "sunucu-gizli-anahtari";
function filterAndSign($email, $key) {
if (filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
return "";
}
return hash_hmac("sha256", $email, $key);
}
echo strlen(filterAndSign("user@example.com", $key)) . "\n";
echo strlen(filterAndSign("not-email", $key)) . "\n";Test yourself
-
Which filter is used to validate an email?
- FILTER_SANITIZE_STRING
- FILTER_VALIDATE_EMAIL
- FILTER_VALIDATE_INT
- FILTER_SANITIZE_NUMBER_INT
Show answer
FILTER_VALIDATE_EMAIL — Correct. FILTER_VALIDATE_EMAIL validates the email format.
-
Complete the filter_var call
$email = "user@example.com"; $valid = ____($email, FILTER_VALIDATE_EMAIL);Show answer
$email = "user@example.com"; $valid = filter_var($email, FILTER_VALIDATE_EMAIL); -
Match the input validation concepts
- filter_var
- Runs value through filter
- FILTER_VALIDATE_EMAIL
- Email format
- hash_hmac
- Produces HMAC
- hash_equals
- Constant-time compare