title: PHP's new input_filter does not read $_GET or $_POST arrays
body: <p>In PHP 5.2 there was a nice security function added called "input_filter", so instead of saying:</p>
  
  <pre><code>$name = $_GET['name'];
  </code></pre>
  
  <p>you can now say:</p>
  
  <pre><code>$name = filter_input (INPUT_GET, 'name', FILTER_SANITIZE_STRING);
  </code></pre>
  
  <p>and it automatically sanitizes your string, there is also:</p>
  
  <ul>
  <li><code>FILTER_SANITIZE_ENCODED</code></li>
  <li><code>FILTER_SANITIZE_NUMBER_INT</code></li>
  <li><code>FILTER_SANITIZE_EMAIL</code></li>
  <li><code>FILTER_SANITIZE_URL</code></li>
  </ul>
  
  <p>etc. 
  so this is a very convenient security feature to use and I want to switch over to it completely.</p>
  
  <p><b>The problem is...</b> I often manipulate the $_GET and $_POST arrays before processing them, like this:</p>
  
  <p>$_GET['name'] = '(default name)';</p>
  
  <p>but it seems that filter_input does not have access to the changes in $_GET since it reads "INPUT_GET" which is of type int (?). It would be nice if I could get filter_input to read $_GET instead but:</p>
  
  <pre><code>$name = filter_input ( $_GET, 'name', FILTER_SANITIZE_STRING );
  </code></pre>
  
  <p>gives me the error:</p>
  
  <pre><code>Warning: filter_input() expects parameter 1 to be long, array given.
  </code></pre>
  
  <p>Can anyone think of a way that I could:</p>
  
  <ul>
  <li>manipulate the source of <code>INPUT_GET</code> (whereever it is) so that I can change its values before filter_input can read them</li>
  <li>get filter_input to read <code>$_GET</code></li>
  </ul>
  
  <p><code>ADDENDUM:</code></p>
  
  <hr/>
  
  <p>Rich asked: "Why are you changing the arrays anyway, surely you want them to be an input, rather than something you've programmatically inserted."</p>
  
  <p>It is just a very convenient place to preprocess variables coming in, e.g. in order to:</p>
  
  <ul>
  <li>set defaults (if $_GET['state'] = '' then $_GET['state'] = 'AL')</li>
  <li>do manual processing (delete all spaces, etc.)</li>
  <li>security (some of which will be done by filter_input now)</li>
  </ul>
  
  <p>Then I know by the time I get the incoming variable, it is secure and valid. Of course I could copy the $_GET array to another array and process THAT array but that is just an unnecessary step since I $_GET is already a functioning array so it makes sense to do it with these system arrays that already exist.</p>