Input Filters clean and normalize raw input (e.g., trim whitespace, strip tags).

Validators enforce rules (e.g., required, length, format, uniqueness).

Common Filters

Common Validators

Example: InputFilter Attached to a Form

1. Form class implementing InputFilterProviderInterface (module/Application/src/Form/RegisterForm.php)

namespace Application\Form;

use Laminas\Form\Form;
use Laminas\InputFilter\InputFilterProviderInterface;

class RegisterForm extends Form implements InputFilterProviderInterface
{
  public function __construct()
  {
    parent::__construct('register');

    $this->add([
      'name' => 'email',
      'type' => 'Email',
      'options' => ['label' => 'Email Address'],
    ]);

    $this->add([
      'name' => 'password',
      'type' => 'Password',
      'options' => ['label' => 'Password'],
    ]);

    $this->add([
      'name' => 'confirm_password',
      'type' => 'Password',
      'options' => ['label' => 'Confirm Password'],
    ]);

    $this->add([
      'name' => 'submit',
      'type' => 'Submit',
      'attributes' => ['value' => 'Register'],
    ]);
  }

  public function getInputFilterSpecification(): array
  {
    return [
      'email' => [
        'required' => true,
        'filters' => [
          ['name' => 'StringTrim'],
          ['name' => 'StripTags'],
          ['name' => 'StringToLower'],
        ],
        'validators' => [
          [
            'name' => 'EmailAddress',
            'options' => [
              'allow' => \Laminas\Validator\Hostname::ALLOW_DNS,
              'useMxCheck' => false,
            ],
          ],
        ],
      ],
      'password' => [
        'required' => true,
        'filters' => [
          ['name' => 'StringTrim'],
        ],
        'validators' => [
          [
            'name' => 'StringLength',
            'options' => [
              'min' => 8,
              'max' => 64,
              'messages' => [
                \Laminas\Validator\StringLength::TOO_SHORT => 'Password must be at least 8 characters',
              ],
            ],
          ],
        ],
      ],
      'confirm_password' => [
        'required' => true,
        'filters' => [
          ['name' => 'StringTrim'],
        ],
        'validators' => [
          [
            'name' => 'Identical',
            'options' => [
              'token' => 'password',
              'messages' => [
                \Laminas\Validator\Identical::NOT_SAME => 'Passwords do not match',
              ],
            ],
          ],
        ],
      ],
    ];
  }
}

2. Controller Usage

public function registerAction()
{
  $form = new \Application\Form\RegisterForm();
  $request = $this->getRequest();

  if ($request->isPost()) {
    $form->setData($request->getPost());

    if ($form->isValid()) {
      $data = $form->getData();
      // Proceed (e.g., create user)
    } else {
      // $form->getMessages() contains validation errors
    }
  }

  return new ViewModel(['form' => $form]);
}

3. View Rendering

<?= $this->form()->openTag($form) ?>
<?= $this->formRow($form->get('email')) ?>
<?= $this->formRow($form->get('password')) ?>
<?= $this->formRow($form->get('confirm_password')) ?>
<?= $this->formSubmit($form->get('submit')) ?>
<?= $this->form()->closeTag() ?>

Errors will be shown per field automatically when using formRow.

Custom Validator Example (module\Application\src\Form\NoAdminNameValidator.php)

use Laminas\Validator\AbstractValidator;

class NoAdminNameValidator extends AbstractValidator
{
  const INVALID = 'invalidName';

  protected $messageTemplates = [
    self::INVALID => "The name 'admin' is not allowed.",
  ];

  public function isValid($value)
  {
    $this->setValue($value);
    if (strtolower($value) === 'admin') {
      $this->error(self::INVALID);
      return false;
    }
    return true;
  }
}

Then in input filter:

use Application\Form\NoAdminNameValidator;

'username' => [
  'required' => true,
  'validators' => [
    [
      'name' => NoAdminNameValidator::class,
    ],
  ],
],

if input value is admin means it show "The name 'admin' is not allowed."

Best Practices

• Always filter raw input before validation.
• Use specific validators instead of loose Callback where possible.
• Leverage error messages for user feedback.
• Group related filters/validators via fieldsets for reuse.
• Use CSRF element to protect forms.