is_numeric() checks if a value can be interpreted as a number, accepting formats like hex, scientific notation, and whitespace, but only returns a boolean without type casting. 2. filter_var() with FILTER_VALIDATE_INT or FILTER_VALIDATE_FLOAT validates and sanitizes by returning the actual number or false, handles range checks, and rejects whitespace. 3. Use is_numeric() for internal type checks on trusted data where performance matters. 4. Use filter_var() for user input validation to ensure security, strict formatting, and proper type conversion. For robust and secure numeric validation of external data, filter_var() is the clear choice.

When validating numeric input in PHP, choosing the right function matters—especially when security, type handling, and edge cases are on the line. Two commonly used tools are is_numeric() and filter_var() with the FILTER_VALIDATE_FLOAT or FILTER_VALIDATE_INT filters. But which one should you actually use, and when?

Let’s break it down.

1. What is_numeric() Actually Does

is_numeric() checks whether a variable can be interpreted as a number in PHP’s loose type system.

is_numeric("42");        // true
is_numeric("3.14");      // true
is_numeric("0xFF");      // true (hexadecimal)
is_numeric("1e4");       // true (scientific notation)
is_numeric(" 123");      // true (leading   sign)
is_numeric("-5.6");      // true
is_numeric("  42 ");     // true (whitespace allowed!)
is_numeric("");          // false
is_numeric("42abc");     // false

? Pros:

• Very permissive—accepts many valid numeric formats.
• Fast and built-in.

? Cons:

• Returns true for strings with leading/trailing whitespace.
• Accepts hex (0xFF) and scientific notation (1e4), which may not be desired.
• Doesn't distinguish between integers and floats.
• No type casting—it only validates, doesn't sanitize.

?? Danger Zone: is_numeric(" 42 ") returns true, but if you're expecting strict input, those spaces might cause issues downstream.

2. How filter_var() Works for Numbers

filter_var() gives you more control by offering dedicated filters:

For integers:

filter_var("42", FILTER_VALIDATE_INT);     // 42
filter_var(" 42 ", FILTER_VALIDATE_INT);   // false
filter_var("42.0", FILTER_VALIDATE_INT);   // false
filter_var("0xFF", FILTER_VALIDATE_INT);   // 255 (valid hex)

For floats:

filter_var("3.14", FILTER_VALIDATE_FLOAT); // 3.14
filter_var("1e4", FILTER_VALIDATE_FLOAT);  // 10000
filter_var(" 3.14 ", FILTER_VALIDATE_FLOAT); // false

? Pros:

• Can validate and sanitize (returns actual number or false).
• More predictable behavior.
• Supports options like min_range, max_range.

// Ensure value is an integer between 1 and 100
filter_var($input, FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 1, 'max_range' => 100]
]);

? Cons:

• Slightly more verbose.
• By default, still accepts hex and scientific notation unless you sanitize them out.

3. Key Differences at a Glance

4. When to Use Which?

? Use is_numeric() when:

• You're doing quick type checks during internal logic.
• Input has already been sanitized.
• You want to accept a broad range of number-like values (including hex, sci notation).
• Performance is critical and input is trusted.

? Use filter_var() when:

• Validating user input (forms, APIs, query params).
• You need to both validate and convert to a proper number.
• You want to enforce strict formatting (no whitespace).
• You need range constraints.

? Security Tip: Always prefer filter_var() for user input—it’s designed for filtering untrusted data.

Bonus: Sanitizing Before Validating

Sometimes you want to allow whitespace but still use filter_var():

$input = trim("  42  ");
filter_var($input, FILTER_VALIDATE_INT); // Now works → 42

Or disallow hex:

filter_var($input, FILTER_VALIDATE_INT, [
    'flags' => FILTER_FLAG_ALLOW_HEX
]); // Omit this flag to reject hex

Final Verdict

• is_numeric() is a type-checking helper, not a validation tool for external input.
• filter_var() is the correct choice for robust, secure numeric validation from users.

? Rule of thumb: If the data comes from outside your script (form, API, URL), use filter_var(). If it's internal and you just need to check type flexibility, is_numeric() is fine.

Basically, it's not really a showdown—each has its place, but for robust validation, filter_var() wins by a mile.

The above is the detailed content of Robust Numeric Validation: `is_numeric()` vs. `filter_var()` Showdown. For more information, please follow other related articles on the PHP Chinese website!