Chapter 7. Zend_InputFilter

Table of Contents

7.1. Introduction
7.1.1. Whitelist Filtering
7.1.2. Blind Filtering
7.1.3. Blacklist Filtering
7.2. Theory of Operation
7.3. Use Cases

7.1. Introduction

Zend_InputFilter provides simple facilities that promote a structured and rigid approach to input filtering. Its purpose is multifaceted, because it caters to the needs of three different groups of people:

  • Developers

    Although filtering input can never be as easy as doing nothing, developers need to ensure the integrity of their data without adding unnecessary complexity to their code. Zend_InputFilter offers simple methods for the most common use cases, extensibility for edge cases, and a strict naming convention that promotes code clarity.

  • Managers

    Managers of all types who need to maintain control over a large group of developers can enforce a structured approach to input filtering by restricting or eliminating access to raw input.

  • Auditors

    Those who audit an application's code need to quickly and reliably identify when and where raw input is used by a developer. The characteristics that promote code clarity also aid auditors by providing a clear distinction among the different approaches to input filtering.

There are a variety of approaches to input filtering, and there are also a variety of facilities that PHP developers can use. Whitelist filtering, blacklist filtering, regular expressions, conditional statements, and native PHP functions are just a few examples of the input filtering potpourri. Zend_InputFilter combines all of these facilities into a single API with consistent behavior and strict naming conventions. All of the methods abide by a simple rule - if the data is valid, it is returned, otherwise FALSE is returned. Extreme simplicity.

7.1.1. Whitelist Filtering

Whitelist filtering methods begin with the is prefix, such as isAlpha() and isEmail(). These methods inspect input according to pre-defined criteria and return the data only if it adheres to the criteria. If not, FALSE is returned. The following provides a simple demonstration:

<?php

$filterPost = new Zend_InputFilter($_POST);

if ($alphaName = $filterPost->isAlpha('name')) {
    /* $alphaName contains only alphabetic characters. */
} else {
    /* $alphaName evaluates to FALSE. */
}

?>
        

This approach errs on the side of caution by performing a boolean evaluation of the return value. If you want to distinguish among values that evaluate to FALSE in PHP (such as the integer 0 and the empty string), you can perform a strict comparison to FALSE:

<?php

$filterPost = new Zend_InputFilter($_POST);
$alphaName = $filterPost->isAlpha('name');

if ($alphaName !== FALSE) {
    /* $alphaName contains only alphabetic characters. */
} else {
    /* $alphaName === FALSE */
}

?>
        

7.1.2. Blind Filtering

Blind filtering methods begin with the get prefix, such as getAlpha() and getDigits(). These methods do not inspect input but instead return the portion of it considered to be valid. For example, getAlpha() returns only the alphabetic characters, if there are any. (If not, the remaining string is the empty string.) The following provides a simple demonstration:

<?php

/* $_POST['username'] = 'John123Doe'; */

$filterPost = new Zend_InputFilter($_POST);
$alphaUsername = $filterPost->getAlpha('username');

/* $alphaUsername = 'JohnDoe'; */

?>
        

7.1.3. Blacklist Filtering

Blacklist filtering methods begin with the no prefix, such as noTags() and noPath(). These methods are identical to the blind filtering methods, except the criteria they enforce is based upon what is considered invalid instead of what is considered valid. Invalid data is removed, and the remaining data (assumed valid) is returned. The following provides a simple demonstration:

<?php

/* $_POST['comment'] = '<b>I love PHP!</b>'; */

$filterPost = new Zend_InputFilter($_POST);
$taglessComment = $filterPost->noTags('comment');

/* $taglessComment = 'I love PHP!'; */

?>