Sanitizing Input

Three words are often mixed up. They are different steps with different jobs.

Validate

Reject anything that does not fit the rule. This is the strongest protection, and you already used it in Form Validation.

Sanitize: gentle cleaning

Sanitizing changes harmless parts of the value. The most common cleaning is trim().

1
2
3
4

<?php
$input = "   isha@example.com \n";

echo "[" . trim($input) . "]";

1

[isha@example.com]

You can also normalise values, for example lowercasing an email or removing everything except digits from a phone number.

1
2
3
4
5

<?php
$email = strtolower(trim("  Isha@Example.COM "));
$phone = preg_replace('/\D+/', '', "+91 98765-43210");

echo $email . "\n" . $phone;

1
2

isha@example.com
919876543210

filter_var sanitize filters

PHP has filters such as FILTER_SANITIZE_NUMBER_INT, but be careful: they remove characters silently and can hide a wrong value. It is usually better to validate and show an error.

Escape: depends on where it goes

Escaping depends on where the value will be used. There is no single “make it safe” function.

1
2
3
4

<?php
$name = 'Isha <script>alert("x")</script>';

echo htmlspecialchars($name, ENT_QUOTES, "UTF-8");

1

Isha <script>alert("x")</script>

Do not store HTML-escaped text

Save the original value in the database, and escape when you print it. If you escape before saving, the text looks broken everywhere else (in an email, in JSON, in a PDF).

Old functions to avoid

• FILTER_SANITIZE_STRING was deprecated in PHP 8.1. Do not use it.
• addslashes() and mysql_real_escape_string() are not the right protection for SQL. Use prepared statements.
• strip_tags() does not make text safe for every context.
• magic_quotes was removed long ago.

A simple intake helper

1
2
3
4
5
6
7
8

<?php
function cleanText(mixed $value): string
{
    return is_string($value) ? trim($value) : "";
}

echo "[" . cleanText("  hello ") . "]\n";
echo "[" . cleanText(["x"]) . "]";

1
2

[hello]
[]