Best Place to Filter Inputs? - 【StackMirror】|php

I am wondering where the best place to filter user submitted input is. In regards to filter, I am talking about filter_var and filter_input.

I've come up with three scenarios:

Filter data from POST/GET, and pass filter data to function which takes it as-is.
Take raw data from POST/GET, and pass as-is to function where the function filters it.
Filter data from POST/GET, and filter is a second time in the function.

Each of these methods has its advantages and disadvantages. I was looking for some insight into which may be best or standard practice.

Method 1 passes sanitized data to the function, and thus functions can be smaller not having to sanitize everything coming in. The downfall is if any other place your function is called and the data isn't sanitized, this can lead to problems. This simply requires good coding practice to remember to sanitize everything before passing to a function.

Method 2 you will never have to worry about your function dealing with unsanitized data, but the functions will be bigger.

Method 3 is the safest, but is wasteful. More code is written, and data may be sanitized multiple times as it passes through possibly various functions, wasting CPU resources and time.

2012-04-05 17:41
by Fase

From the above-mentioned scenarios, 1 & 2 are applicable for good practice. While number 3 is unnecessary to filter input data twice as you said it waste resources.

Thus, scenario 1 or 2; it depends on what situation you are dealing with.

2012-04-05 18:04
by Thavarith

I think every of your methods is a valid one, as long as you make wrong code look wrong.

2012-04-05 17:44
by Benjamin Crouzier

good content on that lin - Gerep 2012-04-05 17:47

That was a great read - Fase 2012-04-09 13:39

as u said,the best method is filtering data sent from input via get or post before using it

2012-04-05 17:45
by Mohamed Amin

But in this scenario, do you then have your function take data as-is without filtering it? This becomes possibly unsafe if any code uses the same function and did not filter it before passing it. If you put the filter after both receiving the data from the user, and in the function, you could be wasting resources filtering the same data over and over again - Fase 2012-04-05 17:48

I think the best option is to filter them using a function so you can re-use your code. Create a class for that and be happy ;)

2012-04-05 17:48
by Gerep

I am specifically asking where is the best place to call filtering and sanitizing the data. Before passing to the function, in the function, or both - Fase 2012-04-05 17:59

as I said, I think the best option is to filter them on your function. "or both", there is no reason at all doing this, one check is enough and will save you resource - Gerep 2012-04-05 18:02