filter_input_array()

Introduction

filter_input_array() filters a whole batch of external input — every field of a $_GET or $_POST request — in a single call, instead of pulling values out of the superglobals one by one. You give it a definition that maps each expected field to a filter (validate or sanitize), and it returns an array of cleaned, type-checked values.

This page covers the syntax, how to read the result (the difference between false, null, and a missing key), how to attach options and flags to individual fields, and how filter_input_array() compares to its single-value and arbitrary-array siblings.

For the bigger picture of PHP's filter extension, see PHP Filters and PHP Advanced Filters.

Syntax

filter_input_array(int $type, array|int $options = FILTER_DEFAULT, bool $add_empty = true): array|false|null

Return value:

• An array of filtered values on success.
• false if $type is invalid.
• null if the requested input source has no data at all (and $add_empty is false).

The crucial part is reading individual entries, not the overall return value:

A self-contained example

filter_input_array() reads from the real INPUT_POST / INPUT_GET sources, which only exist during a web request. To demonstrate the filter definitions in a way you can run on the command line, the snippet below uses filter_var_array() — it accepts the exact same $filters definition and applies the same engine, so the output is identical to what filter_input_array(INPUT_POST, $filters) would produce for that data.

<?php

// In a real request this array would be $_POST.
$input = [
    'name'  => '<b>Jane</b>',
    'age'   => '30',
    'email' => '[email protected]',
];

$filters = [
    'name'  => FILTER_SANITIZE_FULL_SPECIAL_CHARS, // sanitize: escape HTML
    'age'   => FILTER_VALIDATE_INT,                // validate: must be an int
    'email' => FILTER_VALIDATE_EMAIL,              // validate: must be an email
];

$data = filter_var_array($input, $filters);
// In a controller you would write:
// $data = filter_input_array(INPUT_POST, $filters);

print_r($data);

Output:

Array
(
    [name] => <b>Jane</b>
    [age] => 30
    [email] => [email protected]
)

Notice that name was sanitized (the tags were escaped) while age and email were validated (returned as a real int and a verified string). A field that is not listed in $filters is dropped from the result entirely.

Handling invalid and missing fields

Because a failed validation yields false and a missing field yields null, never assume every entry is usable. Check before you trust the data:

<?php

$input = [
    'age'   => 'not-a-number',
    'email' => 'bad-email',
];

$filters = [
    'age'     => FILTER_VALIDATE_INT,
    'email'   => FILTER_VALIDATE_EMAIL,
    'missing' => FILTER_VALIDATE_INT, // declared, but absent from input
];

$data = filter_var_array($input, $filters);

print_r($data);

Output:

Array
(
    [age] =>
    [email] =>
    [missing] =>
)

print_r shows nothing after the keys because age and email are false (invalid) and missing is null (absent). In real code, distinguish them explicitly:

<?php
if ($data['age'] === false) {
    echo "Age is not a valid integer.";
} elseif ($data['age'] === null) {
    echo "Age was not submitted.";
} else {
    echo "Age is {$data['age']}.";
}

Per-field options and flags

Instead of a bare filter constant, a field can be a nested array with filter, options, and flags keys — this is where the function gets powerful. Use options for things like an integer range, and the FILTER_REQUIRE_ARRAY flag when a field arrives as an array (e.g. a multi-select or name="tags[]").

<?php

$input = [
    'age'  => '200',
    'tags' => ['<a>', '<b>'],
];

$args = [
    'age' => [
        'filter'  => FILTER_VALIDATE_INT,
        'options' => ['min_range' => 0, 'max_range' => 120],
    ],
    'tags' => [
        'filter' => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
        'flags'  => FILTER_REQUIRE_ARRAY, // apply the filter to each element
    ],
];

print_r(filter_var_array($input, $args));

Output:

Array
(
    [age] =>
    [tags] => Array
        (
            [0] => <a>
            [1] => <b>
        )

)

age is false because 200 is outside the 0–120 range, and each element of tags was sanitized individually thanks to FILTER_REQUIRE_ARRAY.

How it compares to related functions

Use filter_input_array() when the data lives in $_GET/$_POST/etc.; use filter_var_array() when you already hold the array in a variable.

PHP version compatibility

FILTER_SANITIZE_STRING was deprecated in PHP 8.1 and removed in PHP 8.2. For string sanitization in modern PHP, use FILTER_SANITIZE_FULL_SPECIAL_CHARS (as in the examples above) or, for validation, a dedicated filter such as FILTER_VALIDATE_EMAIL.

Why use it

• Security. Filtering the whole request in one place keeps unvalidated values from leaking into queries or markup. Pair it with form validation and prepared statements.
• Readability. The $filters definition acts as a schema for the expected input, separating validation rules from business logic.
• Consistency. Every field passes through the same vetted engine, so you are not hand-rolling isset() + is_numeric() checks per field.

See also PHP Superglobals for where this input comes from.

Practice