FILTER_SANITIZE_NUMBER_INT does not convert string to int

Question

I thought that the filter_input(type, name, FILTER_SANITIZE_NUMBER_INT) will convert the string to int but it seems it does not.

$id = filter_input(INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT);

if (isset($id) && is_int($id))

Is there another clean but working way to do this?

your first if statement will always default to true because your already defining the $id variable see my other comment — Mujnoi Gyula Tamas, Nov 10 '15 at 14:36
So I just check for `is_int()`? Ok thanks I'm using the ternary operator you made. No need to filter/sanitize? — Chazy Chaz, Nov 10 '15 at 15:48
no need to further sanitize since if you are getting an id in the GET then it will be typecasted to integer, so what you will need to do is check if $id is bigger than 0 if( $id > 0 ){ /* do stuff */ } — Mujnoi Gyula Tamas, Nov 10 '15 at 16:05

score 4 · Accepted Answer · answered Nov 10 '15 at 14:13

4

You can always just cast it:

$id = (int) $_GET['id'];

answered Nov 10 '15 at 14:13

wogsland

9,106
19
57
93

1

don't forget to check if its set $id = isset( $_GET['id'] ) ? (int) $_GET['id'] : 0; else you will get a notice if E_NOTICE is set and you don't have the id index in $_GET – Mujnoi Gyula Tamas Nov 10 '15 at 14:33
Thanks both, so no need to filter/sanitize? – Chazy Chaz Nov 10 '15 at 15:52

score 3 · Answer 2 · edited May 23 '17 at 12:09

3

You can convert a string to an integer in various ways:

$id = (int)$_GET['id']; // Like wogsland showed.
$id = intval($_GET['id']); // This works but is around twice as slow as (int).

Here are some tests that I found, comparing the two: Fastest way to convert string to integer in PHP

edited May 23 '17 at 12:09

Community

1
1

answered Nov 10 '15 at 14:18

Audite Marlow

1,034
1
7
25

Thanks for that link, it is useful. – Chazy Chaz Nov 10 '15 at 15:51

score 1 · Answer 3 · answered Nov 10 '15 at 14:44

Casting to int via (int)$_GET['id'] seems to be the fastest option. You can also use is_numeric() to check if the string is numeric.

Beware that filter_var can return the boolean value false on failure, which will be evaluated as the integer 0.

You can read more about string conversion in the manual.

A warning from the manual: Booleans, floating point numbers and strings can be converted but the behaviour of converting to integer is undefined for other types. Do not rely on any observed behaviour, as it can change without notice!

FILTER_SANITIZE_NUMBER_INT does not convert string to int

3 Answers3