I'm trying to understand about how to mitigate some security threats (SQLi, XSS and so on). However, I'm confused about the filter_input() and filter_var() functions.
What I understand about these functions is:
The filter_input() function filters the user input, that is, if the user enters some SQL statement command, then this command will not be executed, it will be understood as any string, not as a command. So that's your role.
The filter_var() function aims to validate if a certain variable matches the filter type, that is, if it uses filter_var('bob@mail.com', FILTER_VALIDATE_EMAIL), so if the user provides an input that does not match the filter, a boolean value will be returned: false. And then, it's up to the developer to decide what to do in this situation. So, I believe that this function only validates an input following a specific filter, it does not clean the input.
So I'd like to know if I'm right about what I know about these two functions. It's a little confusing to me, the two look similar.
Also, if I'm correct about my line of reasoning, would these two functions, along with parameterized instructions, be effective in mitigating more common threats in web applications? Maybe SQLi and XSS?
I say effective because it's not enough. Web application security doesn't just demand that. However, I believe you understand what I mean by this.