In PHP 5.2 there was a nice security function added called "input_filter", so instead of saying:
$name = $_GET['name'];
you can now say:
$name = filter_input (INPUT_GET, 'name', FILTER_SANITIZE_STRING);
and it automatically sanitizes your string, there is also:
so this is a very convenient security feature to use and I want to switch over to it completely.
The problem is...
I often manipulate the $_GET and $_POST arrays before processing them, like this:
$_GET['name'] = '(default name)';
but it seems that filter_input does not have access to the changes in $_GET since it reads "INPUT_GET" which is of type int (?). It would be nice if I could get filter_input to read $_GET instead but:
$name = filter_input ( $_GET, 'name', FILTER_SANITIZE_STRING );
gives me the error:
Warning: filter_input() expects parameter 1 to be long, array given.
Can anyone think of a way that I could:
- manipulate the source of
(whereever it is) so that I can change its values before filter_input can read them
- get filter_input to read
Rich asked: "Why are you changing the arrays anyway, surely you want them to be an input, rather than something you've programmatically inserted."
It is just a very convenient place to preprocess variables coming in, e.g. in order to:
- set defaults (if $_GET['state'] = '' then $_GET['state'] = 'AL')
- do manual processing (delete all spaces, etc.)
- security (some of which will be done by filter_input now)
Then I know by the time I get the incoming variable, it is secure and valid. Of course I could copy the $_GET array to another array and process THAT array but that is just an unnecessary step since I $_GET is already a functioning array so it makes sense to do it with these system arrays that already exist.