filter_var()

Introduction

filter_var() is PHP's built-in tool for validating and sanitizing a single value. Validating means checking whether a value matches an expected shape (a real email, an integer in range, a valid URL) and returning the value if it does or false if it doesn't. Sanitizing means cleaning a value by stripping or escaping characters that don't belong.

Never trust data that comes from outside your script — form fields, query strings, cookies, API payloads. Running it through filter_var() before you store, display, or act on it is one of the simplest ways to keep your application safe and predictable. This page covers the syntax, the two modes (validate vs. sanitize), the common filters and flags, and the gotchas that trip people up.

Syntax

filter_var(mixed $value, int $filter = FILTER_DEFAULT, array|int $options = 0): mixed

Return value: the filtered (and possibly converted) value on success, or false on failure. Note that a validate filter returns the value itself — so always compare with === when the valid value could be falsy (like 0 or an empty string).

Validating data

Validation answers a yes/no question: is this value acceptable? The filter returns the value on success and false on failure.

Validate an email address

The most useful validate filters are:

The === false trap

Because a validate filter returns the value, a result of 0 or "0" is valid but falsy. Always use a strict comparison:

Sanitizing data

Sanitization doesn't reject a value — it cleans it and returns the cleaned string.

Sanitize an email address

Common sanitize filters:

Note: FILTER_SANITIZE_STRING was deprecated in PHP 8.1. To clean strings for HTML output, prefer htmlspecialchars() at the point of display.

Using options and flags

The third argument fine-tunes a filter. Pass it as an array with 'options' (and optionally 'flags'):

Flags can also be passed directly as the third argument when you don't need the array form:

Validate vs. sanitize — when to use which

• Validate when you need a yes/no decision: reject the request, show an error, retry. Use validate filters for emails, numbers, URLs, and IPs in forms and APIs.
• Sanitize when you must accept the input but want it cleaned of dangerous or stray characters before use.
• The two are complementary — a common pattern is to validate on input and escape (e.g. with htmlspecialchars()) on output, rather than relying on sanitize filters alone.

Common gotchas

• A validate filter returns the value, not true. Compare with === false to detect failure.
• filter_var() works on a single scalar value. To filter many values at once, use filter_var_array() or, for request data, filter_input_array().
• FILTER_VALIDATE_BOOLEAN returns null (not false) for unrecognized values only when you pass FILTER_NULL_ON_FAILURE; otherwise it returns false.
• Don't rely on sanitize filters for security-critical output escaping — escape at the moment of rendering instead.

Related topics

• filter_var_array() — filter many variables in one call.
• filter_input_array() — filter request data ($_GET, $_POST).
• PHP Form Validation — putting these filters to work on real forms.
• Validate URL & Email in PHP
• htmlspecialchars() — escaping for safe HTML output.
• trim() — strip whitespace before filtering.

Conclusion

filter_var() is a compact, dependable way to validate and sanitize individual values in PHP. Reach for the validate filters to accept or reject input, the sanitize filters to clean it, and remember to compare validate results with === false. Combined with filter_var_array() for bulk data and htmlspecialchars() for output, it forms the backbone of safe input handling.

Practice