Table of Contents
Zend_InputFilter
provides simple facilities that
promote a structured and rigid approach to input filtering. Its purpose is
multifaceted, because it caters to the needs of three different groups of
people:
Developers
Although filtering input can never be as easy as doing
nothing, developers need to ensure the integrity of their data
without adding unnecessary complexity to their code.
Zend_InputFilter
offers simple methods for the
most common use cases, extensibility for edge cases, and a strict
naming convention that promotes code clarity.
Managers
Managers of all types who need to maintain control over a large group of developers can enforce a structured approach to input filtering by restricting or eliminating access to raw input.
Auditors
Those who audit an application's code need to quickly and reliably identify when and where raw input is used by a developer. The characteristics that promote code clarity also aid auditors by providing a clear distinction among the different approaches to input filtering.
There are a variety of approaches to input filtering, and there are
also a variety of facilities that PHP developers can use. Whitelist
filtering, blacklist filtering, regular expressions, conditional
statements, and native PHP functions are just a few examples of the input
filtering potpourri. Zend_InputFilter
combines all of
these facilities into a single API with consistent behavior and strict
naming conventions. All of the methods abide by a simple rule - if the data
is valid, it is returned, otherwise FALSE
is returned.
Extreme simplicity.
Whitelist filtering methods begin with the is
prefix, such as isAlpha()
and
isEmail()
. These methods inspect input according to
pre-defined criteria and return the data only if it adheres to the
criteria. If not, FALSE
is returned. The following
provides a simple demonstration:
<?php $filterPost = new Zend_InputFilter($_POST); if ($alphaName = $filterPost->isAlpha('name')) { /* $alphaName contains only alphabetic characters. */ } else { /* $alphaName evaluates to FALSE. */ } ?>
This approach errs on the side of caution by performing a boolean
evaluation of the return value. If you want to distinguish among values
that evaluate to FALSE
in PHP (such as the integer
0
and the empty string), you can perform a strict
comparison to FALSE
:
<?php $filterPost = new Zend_InputFilter($_POST); $alphaName = $filterPost->isAlpha('name'); if ($alphaName !== FALSE) { /* $alphaName contains only alphabetic characters. */ } else { /* $alphaName === FALSE */ } ?>
Blind filtering methods begin with the get
prefix, such as getAlpha()
and
getDigits()
. These methods do not inspect input but
instead return the portion of it considered to be valid. For example,
getAlpha()
returns only the alphabetic characters,
if there are any. (If not, the remaining string is the empty string.)
The following provides a simple demonstration:
<?php /* $_POST['username'] = 'John123Doe'; */ $filterPost = new Zend_InputFilter($_POST); $alphaUsername = $filterPost->getAlpha('username'); /* $alphaUsername = 'JohnDoe'; */ ?>
Blacklist filtering methods begin with the no
prefix, such as noTags()
and
noPath()
. These methods are identical to the blind
filtering methods, except the criteria they enforce is based upon what
is considered invalid instead of what is considered valid. Invalid data
is removed, and the remaining data (assumed valid) is returned. The
following provides a simple demonstration:
<?php /* $_POST['comment'] = '<b>I love PHP!</b>'; */ $filterPost = new Zend_InputFilter($_POST); $taglessComment = $filterPost->noTags('comment'); /* $taglessComment = 'I love PHP!'; */ ?>