What is the difference between input validation and input sanitization in PHP?

Input validation is the process of ensuring that the data provided by the user meets certain criteria, such as being in the correct format or within a specific range. Input sanitization, on the other hand, is the process of cleaning or filtering the data to remove any potentially harmful characters or code. Both are important in preventing security vulnerabilities and ensuring the integrity of the data being processed. 

// Input validation example
$username = $_POST['username'];

if (preg_match('/^[a-zA-Z0-9]{5,}$/', $username)) {
    // Username is valid
} else {
    // Username is invalid
}

// Input sanitization example
$email = $_POST['email'];

$clean_email = filter_var($email, FILTER_SANITIZE_EMAIL);

Keywords

input validation input sanitization PHP security data filtering

Related Questions