Question

In PHP 5.2 there was a nice security function added called ‘input_filter’, so instead of saying:

$name = $_GET['name']; 

you can now say:

$name = filter_input (INPUT_GET, 'name', FILTER_SANITIZE_STRING); 

and it automatically sanitizes your string, there is also:

• FILTER_SANITIZE_ENCODED
• FILTER_SANITIZE_NUMBER_INT
• FILTER_SANITIZE_EMAIL
• FILTER_SANITIZE_URL

etc. so this is a very convenient security feature to use and I want to switch over to it completely.

The problem is… I often manipulate the $_GET and $_POST arrays before processing them, like this:

$_GET[‘name’] = ‘(default name)’;

but it seems that filter_input does not have access to the changes in $_GET since it reads ‘INPUT_GET’ which is of type int (?). It would be nice if I could get filter_input to read $_GET instead but:

$name = filter_input ( $_GET, 'name', FILTER_SANITIZE_STRING ); 

gives me the error:

Warning: filter_input() expects parameter 1 to be long, array given. 

Can anyone think of a way that I could:

• manipulate the source of INPUT_GET (whereever it is) so that I can change its values before filter_input can read them
• get filter_input to read $_GET

ADDENDUM:

---

Rich asked: ‘Why are you changing the arrays anyway, surely you want them to be an input, rather than something you’ve programmatically inserted.’

It is just a very convenient place to preprocess variables coming in, e.g. in order to:

• set defaults (if $_GET[‘state’] = ” then $_GET[‘state’] = ‘AL’)
• do manual processing (delete all spaces, etc.)
• security (some of which will be done by filter_input now)

Then I know by the time I get the incoming variable, it is secure and valid. Of course I could copy the $_GET array to another array and process THAT array but that is just an unnecessary step since I $_GET is already a functioning array so it makes sense to do it with these system arrays that already exist.

Answer 1

You could manually force it to read the arrays again by using filter_var and filter_var_array

$name = filter_var ( $_GET['name'], FILTER_SANITIZE_STRING );