filter_var_array()

Introduction

PHP provides a range of built-in functions for filtering and validating user input data. One such function is filter_var_array(), which applies filters to many variables at once instead of calling filter_var() repeatedly. It is the workhorse behind clean form processing: you describe the rules for every field in a single array, pass the raw input in, and get back a fully validated and sanitized result.

This chapter covers the syntax, the three ways to define filters, how the $add_empty flag behaves, how to read the return value, and the common gotchas — with runnable examples.

Syntax

The syntax for filter_var_array() is as follows:

The PHP syntax of filter_var_array()

filter_var_array ( array $data , mixed $definition [, bool $add_empty = true ] ) : mixed

The function returns the filtered array on success, or false on failure (for example, if $data is not an array).

The three ways to define filters

The $definition parameter is the heart of this function. It can take three forms.

1. One filter for every value — pass a single filter constant:

<?php
$data = ['a' => '1', 'b' => 'not-a-number', 'c' => '42'];
$result = filter_var_array($data, FILTER_VALIDATE_INT);
print_r($result);

Output — values that fail the filter become false:

Array
(
    [a] => 1
    [b] =>
    [c] => 42
)

2. A per-key filter map — map each key to its own filter constant:

<?php
$data = [
    'name'  => '  John  ',
    'age'   => '30',
    'email' => '[email protected]',
];

$definition = [
    'name'  => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
    'age'   => FILTER_VALIDATE_INT,
    'email' => FILTER_VALIDATE_EMAIL,
];

print_r(filter_var_array($data, $definition));

Array
(
    [name] =>   John  
    [age] => 30
    [email] => [email protected]
)

3. A per-key array with filter, flags and options — for fine-grained control, map a key to an array that names the filter plus flags and options:

<?php
$data = ['age' => '150', 'tags' => ['php', 'mysql']];

$definition = [
    'age' => [
        'filter'  => FILTER_VALIDATE_INT,
        'options' => ['min_range' => 0, 'max_range' => 120],
    ],
    'tags' => [
        'filter' => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
        'flags'  => FILTER_REQUIRE_ARRAY,
    ],
];

var_dump(filter_var_array($data, $definition));

array(2) {
  ["age"]=>
  bool(false)
  ["tags"]=>
  array(2) {
    [0]=>
    string(3) "php"
    [1]=>
    string(5) "mysql"
  }
}

age is false because 150 is outside the 0–120 range, and FILTER_REQUIRE_ARRAY tells the filter to treat tags as an array and sanitize each element.

Usage with form input

In real code the $data array is usually a superglobal such as $_POST. The same definition you just saw applies the rules and stores the cleaned values in $result:

Example of PHP filter_var_array()

<?php

$filters = [
    'name'  => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
    'age'   => FILTER_VALIDATE_INT,
    'email' => FILTER_VALIDATE_EMAIL,
];

// $add_empty = false skips keys missing from $_POST instead of adding them as null
$result = filter_var_array($_POST, $filters, false);

if ($result === false || $result['email'] === false) {
    // Handle missing or invalid input
    echo 'Please correct the form.';
} else {
    // $result now holds clean, validated values
}

Note that a failed validation produces false for that key, while the function only returns false overall when $data itself is invalid. Always inspect both. For filtering $_POST or $_GET directly from the input stream, see the closely related filter_input_array().

Note: FILTER_SANITIZE_STRING was removed in PHP 8.0. Use FILTER_SANITIZE_FULL_SPECIAL_CHARS instead.

Benefits

Applying filter_var_array() enhances the security and reliability of your PHP application by processing many variables in one call. Validating input before further processing ensures your application only accepts expected data, reducing the risk of injection and malformed-data bugs. Keeping the rules in a declarative $definition array also separates validation from business logic, making scripts more modular and easier to maintain.

Conclusion

filter_var_array() is the efficient way to validate and sanitize a whole set of variables at once. Choose the definition form that fits your need — one filter for all, a per-key map, or per-key option arrays — and always check for false per field. To go deeper, read the PHP filters overview and the PHP form validation chapter.

Practice