Zend_InputFilter
consolidates a few distinct
approaches to input filtering into a single API with consistent behavior
and strict naming conventions (see
Section 7.1, “Introduction”). These characteristics
bring Zend_InputFilter
on par with existing solutions,
but they do nothing to further aid those who require a more structured or
rigid approach. Therefore, by default, Zend_InputFilter
enforces controlled access to input.
Two syntaxes are supported. In the default (strict) approach, a single argument is passed to the constructor - the array to be filtered:
<?php $filterPost = new Zend_InputFilter($_POST); $email = $filterPost->isEmail('email'); ?>
Zend_InputFilter
sets the array that is passed
($_POST
) to NULL
, so direct access is
no longer possible. (The raw data is only available through the
getRaw()
method, which is much easier to monitor and/or
avoid altogether.)
In the optional (non-strict) approach, FALSE
is
passed as the second argument to the constructor:
<?php $filterPost = new Zend_InputFilter($_POST, FALSE); $email = $filterPost->isEmail('email'); ?>
The use of the filter is exactly the same, but
Zend_InputFilter
does not set the original array
($_POST
) to NULL
, so developers can
still access it directly. This approach is discouraged in favor of the
strict approach.
Zend_InputFilter
is designed primarily with arrays
in mind. Many sources of input are already covered by PHP's superglobal
arrays ($_GET
, $_POST
,
$_COOKIE
, etc.), and arrays are a common construct used
to store input from other sources. If you need to filter a scalar, see
Chapter 5, Zend_Filter.