What would be better Practice when sanitizing/validating php from html inputs?

34 views Asked by At

When doing php validation should I First do the filter sanitizing/validating or is it okay to do it as part of an if statement see the examples below

First Example

$vvalidation = 0;

if (isset($_POST['db9_name']) && $_POST['db9_name'] != ''){
    $name = $_POST['db9_name'];
    if (filter_var($name, FILTER_SANITIZE_STRING === null)){
        $vvalidation++;
    }
} else{
    $vvalidation++;
}

Second Example

$vvalidation = 0;

if (isset($_POST['db9_name']) && $_POST['db9_name'] != ''){
    $name = $_POST['db9_name'];    
    $vname = filter_var($name, FILTER_SANITIZE_STRING);
    if ($vname === null)){
        $vvalidation++;
    }
} else{
    $vvalidation++;
}

and for email ?

example 1

  if (isset($_POST['txtemail']) && $_POST['txtemail'] !== '') {

        $vEmail = strtolower(strip_tags(trim($_POST['txtemail'])));
        $vEmail = str_replace(' ', '', $vEmail);

        if (filter_var($vEmail, FILTER_SANITIZE_EMAIL) === null) {
            $vValidation++;
        } elseif (filter_var($vEmail, FILTER_VALIDATE_EMAIL) === null) {
            $vValidation++;
        }
    } else {
        $vValidation++;
}

example 2

  if (isset($_POST['txtemail']) && $_POST['txtemail'] !== '') {

        $vEmail = strtolower(strip_tags(trim($_POST['txtemail'])));
        $vEmail = str_replace(' ', '', $vEmail);

       $email = (filter_var($vEmail, FILTER_SANITIZE_EMAIL);
       $email .= (filter_var($vEmail, FILTER_VALIDATE_EMAIL);
        if (email === null){
        $vValidation++;
    } else {

        $vValidation++;
}

or does it not really matter?

0

There are 0 answers