filter_input()

Introduction

filter_input() is a built-in PHP function that reads a single external variable — from $_GET, $_POST, cookies, the server environment, or getenv() — and runs it through a filter in one step. A filter either sanitizes the value (strips or escapes unwanted characters) or validates it (checks that it matches an expected format and rejects it otherwise).

The key reason to reach for filter_input() instead of touching $_GET['x'] directly is safety by design: you never get a raw superglobal in your hands, the function reports cleanly when a variable is missing, and the filter is applied at the exact moment you read the value. This page covers the syntax, the difference between sanitizing and validating, how to read its three possible return values, and a complete form-handling example.

Looking to filter a value you already have in a variable (not from a superglobal)? Use filter_var(). To filter many fields at once, see filter_input_array().

Syntax

filter_input(int $type, string $var_name, int $filter = FILTER_DEFAULT, array|int $options = 0): mixed

What it returns

filter_input() has three possible return values, and distinguishing them is the whole point of using it:

• the filtered value on success;
• false if filtering (validation) fails;
• null if the variable is not set in the requested input source.

Because false and null mean different things, compare with === rather than a loose truthiness check.

Sanitizing vs. validating

This is the most common point of confusion, so make the choice deliberately:

• Sanitize (FILTER_SANITIZE_*) — clean the value and return the cleaned string. It almost never "fails"; it just removes or escapes characters.
• Validate (FILTER_VALIDATE_*) — check the value and return it unchanged on success or false on failure. Use this whenever the field has a strict shape (email, integer, URL, boolean).

FILTER_SANITIZE_STRING was removed in PHP 8.0. Use FILTER_SANITIZE_FULL_SPECIAL_CHARS (or htmlspecialchars() at output time) instead.

Sanitizing input

The example below reads a name field from a POST request and escapes any HTML special characters so the value is safe to store and echo later.

<?php

$name = filter_input(INPUT_POST, 'name', FILTER_SANITIZE_FULL_SPECIAL_CHARS);

if ($name === null) {
    $name = '';          // field was not submitted at all
}

echo $name;

FILTER_SANITIZE_FULL_SPECIAL_CHARS HTML-encodes every special character (similar to htmlspecialchars() with ENT_QUOTES), so <b>Joe</b> becomes <b>Joe</b>.

Validating input

For fields with a fixed format, validate instead of sanitize. Here FILTER_VALIDATE_EMAIL returns the address on success or false on failure:

<?php

$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);

if ($email === null) {
    echo "No email submitted.";
} elseif ($email === false) {
    echo "Invalid email address.";
} else {
    echo "Valid email: $email";
}

Validating numbers with options

The fourth parameter lets you constrain a value. This accepts an integer page number only when it falls between 1 and 100, and falls back to 1 otherwise:

<?php

$page = filter_input(INPUT_GET, 'page', FILTER_VALIDATE_INT, [
    'options' => [
        'min_range' => 1,
        'max_range' => 100,
        'default'   => 1,   // returned when validation fails
    ],
]);

echo "Page: $page";

A complete form example

In a real request you read each field straight from the input source:

<?php

$name  = filter_input(INPUT_POST, 'name',  FILTER_SANITIZE_FULL_SPECIAL_CHARS);
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
$age   = filter_input(INPUT_POST, 'age',   FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 0, 'max_range' => 120],
]);

$errors = [];
if ($email === false) {
    $errors[] = 'Invalid email.';
}
if ($age === false) {
    $errors[] = 'Age must be a whole number between 0 and 120.';
}

if ($errors) {
    echo implode("\n", $errors);
} else {
    echo "Name:  $name\nEmail: $email\nAge:   $age\n";
}

For a valid submission (name=<b>Jane</b>, [email protected], age=34) this prints:

Name:  <b>Jane</b>
Email: [email protected]
Age:   34

Note: filter_input() reads the variables PHP captured from the actual HTTP request, not values you later assign to $_GET/$_POST in code. That makes it tamper-resistant, but it also means the function returns null for every field when a script is run from the command line with no request behind it — test input filters with filter_var() on a sample string instead.

When to use it

Use filter_input() whenever a value enters your application from the outside world:

• Query strings and forms — pull INPUT_GET / INPUT_POST fields with the right validator instead of trusting raw superglobals.
• Pagination, IDs, prices — FILTER_VALIDATE_INT / FILTER_VALIDATE_FLOAT with a range guard rejects out-of-bounds or non-numeric input before it reaches a query.
• Contact forms — FILTER_VALIDATE_EMAIL and FILTER_VALIDATE_URL enforce shape at the boundary. See the worked walkthrough in PHP Form Validation.

Filtering at the input boundary keeps validation logic in one place and separates it from your business logic, which makes the code easier to read, test, and audit. For the full list of available filters, see PHP Filters.

Conclusion

filter_input() reads one external variable and filters it in a single, well-defined step. Reach for a FILTER_VALIDATE_* filter when a field has a strict format and a FILTER_SANITIZE_* filter when you only need to clean a value, and always check the return with === so you can tell a missing variable (null) apart from a failed one (false).

Practice