PHP怎么过滤数组数据_PHP数组元素安全过滤方法

array_filter

filter_var

array_filter()

true

<?php
$data = [1, 0, 'hello', '', null, false, 50, '  '];

// 1. 移除所有“空”值（false, null, '', 0等）
// array_filter默认不传回调函数时，会移除所有等同于false的值
$filtered_data_simple = array_filter($data);
print_r($filtered_data_simple);
/*
Array
(
    [0] => 1
    [2] => hello
    [6] => 50
    [7] =>
)
*/

// 2. 移除空字符串，但保留0和false
$filtered_data_custom = array_filter($data, function($value) {
    // 这里的trim是为了处理只有空格的字符串
    return !is_string($value) || trim($value) !== '';
});
print_r($filtered_data_custom);
/*
Array
(
    [0] => 1
    [1] => 0
    [2] => hello
    [4] =>
    [5] =>
    [6] => 50
)
*/

// 3. 过滤掉非数字的元素
$numbers_only = array_filter($data, 'is_numeric');
print_r($numbers_only);
/*
Array
(
    [0] => 1
    [1] => 0
    [6] => 50
)
*/
?>

array_filter

foreach

<?php
$raw_input = [
    'name' => '  John Doe  ',
    'email' => 'test@example.com',
    'age' => '30a', // 故意设置一个错误年龄
    'website' => 'http://www.example.com',
    'notes' => '<script>alert("hack");</script>',
    'status' => 'active'
];

$safe_data = [];
foreach ($raw_input as $key => $value) {
    switch ($key) {
        case 'name':
            // 清理两端空白，并限制长度
            $safe_data[$key] = substr(trim($value), 0, 50);
            break;
        case 'email':
            // 使用filter_var进行邮件格式验证和净化
            $safe_email = filter_var($value, FILTER_SANITIZE_EMAIL);
            if (filter_var($safe_email, FILTER_VALIDATE_EMAIL)) {
                $safe_data[$key] = $safe_email;
            } else {
                // 处理无效邮件，比如设置为null或抛出错误
                $safe_data[$key] = null;
            }
            break;
        case 'age':
            // 验证并转换为整数
            $safe_age = filter_var($value, FILTER_VALIDATE_INT);
            if ($safe_age !== false) { // filter_var失败返回false
                $safe_data[$key] = $safe_age;
            } else {
                $safe_data[$key] = null; // 无效年龄
            }
            break;
        case 'website':
            // URL净化和验证
            $safe_website = filter_var($value, FILTER_SANITIZE_URL);
            if (filter_var($safe_website, FILTER_VALIDATE_URL)) {
                $safe_data[$key] = $safe_website;
            } else {
                $safe_data[$key] = null;
            }
            break;
        case 'notes':
            // HTML实体编码，防止XSS攻击
            $safe_data[$key] = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
            break;
        default:
            // 默认情况下，对其他字段进行通用字符串净化
            $safe_data[$key] = filter_var($value, FILTER_SANITIZE_STRING);
            break;
    }
}

print_r($safe_data);
/*
Array
(
    [name] => John Doe
    [email] => test@example.com
    [age] =>
    [website] => http://www.example.com
    [notes] => <script>alert("hack");</script>
    [status] => active
)
*/
?>

age

'30a'

null

array_filter

array_map

foreach

filter_var

$_POST

$_GET

filter_input_array()

<?php
// 模拟用户提交的POST数据
$_POST = [
    'username' => '  admin  ',
    'email' => 'invalid-email',
    'age' => '25',
    'comment' => '<script>alert("XSS");</script>Hello World!',
    'website' => 'ftp://malicious.com',
    'roles' => ['admin', 'editor', 'guest'] // 这是一个数组，filter_input_array默认处理不了嵌套
];

$args = [
    'username' => [
        'filter' => FILTER_SANITIZE_STRING, // 净化字符串
        'flags' => FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH, // 移除特殊字符
        'options' => ['min_range' => 3, 'max_range' => 50] // 长度限制
    ],
    'email' => FILTER_VALIDATE_EMAIL, // 验证邮件格式
    'age' => [
        'filter' => FILTER_VALIDATE_INT, // 验证整数
        'options' => ['min_range' => 18, 'max_range' => 120] // 年龄范围
    ],
    'comment' => FILTER_SANITIZE_FULL_SPECIAL_CHARS, // 对HTML特殊字符进行编码
    'website' => FILTER_VALIDATE_URL, // 验证URL格式
    'roles' => [ // 这是一个数组，需要单独处理每个元素
        'filter' => FILTER_SANITIZE_STRING,
        'flags' => FILTER_REQUIRE_ARRAY // 确保它是一个数组
    ]
];

// 使用filter_input_array处理POST数据
$filtered_input = filter_input_array(INPUT_POST, $args);

print_r($filtered_input);

// 检查过滤结果
if ($filtered_input['username'] === false || $filtered_input['username'] === null) {
    echo "用户名无效或缺失。\n";
}
if ($filtered_input['email'] === false) {
    echo "邮箱格式不正确。\n";
}
if ($filtered_input['age'] === false) {
    echo "年龄无效或不在范围内。\n";
}
if ($filtered_input['website'] === false) {
    echo "网站URL无效。\n";
}
if (is_array($filtered_input['roles'])) {
    // 进一步处理roles数组，例如检查每个角色是否在允许列表中
    $allowed_roles = ['admin', 'editor', 'viewer'];
    $safe_roles = array_filter($filtered_input['roles'], function($role) use ($allowed_roles) {
        return in_array($role, $allowed_roles);
    });
    $filtered_input['roles'] = $safe_roles;
}

print_r($filtered_input);
/*
Array
(
    [username] => admin
    [email] =>
    [age] => 25
    [comment] => <script>alert("XSS");</script>Hello World!
    [website] =>
    [roles] => Array
        (
            [0] => admin
            [1] => editor
            [2] => guest
        )

)
邮箱格式不正确。
网站URL无效。
Array
(
    [username] => admin
    [email] =>
    [age] => 25
    [comment] => <script>alert("XSS");</script>Hello World!
    [website] =>
    [roles] => Array
        (
            [0] => admin
            [1] => editor
        )

)
*/
?>

filter_input_array

false

null

filter_input_array

roles

roles

filter_input_array