I must be doing something fundamentally wrong here, but I cannot see what it is. In the process of discovering what exactly filter_input does, I wrote this test to show the gozintas and gozoutas.
for($i = 0; $i <= 255; ++$i) {
if ($i == 0) {
$c1 = "What@The@Heck";
} else {
$c1 = chr($i);
}
$_GET['c1'] = $c1;
print "GET="; var_dump($_GET); print "<br>";
$c2 = filter_input(INPUT_GET, 'c1');
$c3 = filter_input(INPUT_GET, 'c1', FILTER_SANITIZE_SPECIAL_CHARS);
$c4 = filter_input(INPUT_GET, 'c1', FILTER_SANITIZE_ENCODED);
$c5 = filter_input(INPUT_GET, 'c1', FILTER_SANITIZE_STRING, FILTER_FORCE_ARRAY);
print "i=$i c1=$c1 c2=$c2 c3=$c3 c4=$c4 c5=$c5<br>";
print "c5=";var_dump($c5); print "<br>";
}
All the output looks like this:
...
GET=array(1) { ["c1"]=> string(1) ">" }
i=62 c1=> c2= c3= c4= c5=
c5=NULL
GET=array(1) { ["c1"]=> string(1) "?" }
i=63 c1=? c2= c3= c4= c5=
c5=NULL
GET=array(1) { ["c1"]=> string(1) "@" }
i=64 c1=@ c2= c3= c4= c5=
c5=NULL
GET=array(1) { ["c1"]=> string(1) "A" }
i=65 c1=A c2= c3= c4= c5=
c5=NULL
GET=array(1) { ["c1"]=> string(1) "B" }
i=66 c1=B c2= c3= c4= c5=
c5=NULL
GET=array(1) { ["c1"]=> string(1) "C" }
i=67 c1=C c2= c3= c4= c5=
c5=NULL
...
It’s really confounding because I know filter_input is used elsewhere in our code in the same way with no problems. Running php 8.3.11. Have mercy on a burned-out programmer.
I stumbled on the answer, and it’s really surprising. This is from php.net filter_has_var User contributed notes from drm at melp dot nl.
// Please note that the function does not check the live array, it actually checks the content received by php:
$_GET['test'] = 'ABC';
echo filter_has_var(INPUT_GET,'test') ? 'Yes' : 'No';
// would say "No", unless the parameter was actually in the query string.
// Also, if the input var is empty, it will say Yes.
So, filter_input looks at some internal version of the $_GET array data, NOT the actual array itself. Why? What possible reason could there be for this? And why was it not documented? I am rapidly coming to the conclusion that filter_input, et al, is not ready for prime time. It might be better if I just did not use it at all, and stick to my own custom filter functions.