filter_has_var()

filter_has_var() checks whether a variable from a specific input source (GET, POST, cookies, the server, or the environment) exists. This page covers its syntax, the input-source constants, how it differs from isset(), and the gotchas that trip people up.

What filter_has_var() does

filter_has_var() answers a single question: did this input source actually send a variable with this name? It returns true or false.

It does not read the value, sanitize it, or validate it — for that you reach for filter_input() or filter_var(). Think of filter_has_var() as a presence check that looks at the original input stream rather than at the $_GET / $_POST superglobals, which your code may have modified at runtime.

Syntax

filter_has_var(int $input_type, string $var_name): bool

It returns true if a variable named $var_name is present in the given input source, and false otherwise.

Input source constants

Gotcha: INPUT_REQUEST and INPUT_SESSION are defined as constants but are not implemented. Passing them always returns false. Use INPUT_GET / INPUT_POST explicitly instead.

Basic example

Imagine a request like [email protected]. You can check which query-string variables were sent:

<?php
// Given the query string: [email protected]

var_dump(filter_has_var(INPUT_GET, 'email'));    // bool(true)  — sent
var_dump(filter_has_var(INPUT_GET, 'username')); // bool(false) — not sent

Output (when that request is actually made to the server):

bool(true)
bool(false)

Important: filter_has_var() inspects the data PHP captured at the start of the request, not the current contents of the $_GET / $_POST superglobals. Assigning to $_GET later in your script does not change what filter_has_var() sees. This also means it returns false for everything when PHP runs from the command line, because there is no HTTP request to read from.

Validating that a field was submitted

The most common use is guarding form handling: confirm the field exists before you try to validate it. Here filter_has_var() distinguishes "the field is missing" from "the field is present but invalid".

<?php

if (filter_has_var(INPUT_POST, 'email')) {
    $email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
    if ($email !== false && $email !== null) {
        echo "Valid email: $email";
    } else {
        echo 'Invalid email address.';
    }
} else {
    echo 'Email field is missing.';
}

If the email field never appears in the POST body, you get the "missing" branch. If it appears but is malformed, filter_input() returns false and you get the "invalid" branch.

filter_has_var() vs. isset()

People often ask why not just use isset($_POST['email']). They overlap, but there are two real differences:

1. Source of truth. isset($_POST['x']) reads the $_POST array, which your application may have unset or overwritten. filter_has_var() looks at the original request data PHP captured, so it is harder to fool.
2. Empty values still count as "present". An empty submitted value (newsletter=) exists, so filter_has_var() returns true. If you need "present and non-empty", check the value with empty():

<?php
// Simulate a present-but-empty submitted field.
$_GET['newsletter'] = '';

var_dump(isset($_GET['newsletter']));  // bool(true)  — the key exists
var_dump(empty($_GET['newsletter']));  // bool(true)  — but the value is empty

Output:

bool(true)
bool(true)

So filter_has_var() confirms presence; pair it with empty() when an empty string should be treated as "not provided".

Why use it

• Clear intent. It documents that a code path depends on a specific input source, not just on whatever happens to be in a superglobal.
• Safer guards. Reading the raw input stream avoids false positives from variables your own code added at runtime.
• Composable validation. Separating the presence check (filter_has_var()) from the value check (filter_input() / filter_var()) keeps validation logic modular and easy to read, which in turn reduces the chance of accepting unexpected input that leads to issues like SQL injection or XSS.

Conclusion

filter_has_var() is a focused presence check for request input: it tells you whether an INPUT_GET, INPUT_POST, INPUT_COOKIE, INPUT_SERVER, or INPUT_ENV variable was sent, and nothing more. Combine it with filter_input() or filter_var() to validate the value, and with empty() when an empty value should count as missing.

Practice