filter_list
Returns the names of every filter this PHP build supports, as an array of strings.
filter_list(): array- Added in PHP 5.2.0
Return value
arrayA list of the names of all supported filters, or an empty array if there are none. The array indexes are not filter IDs.
Changelog
- PHP 8.0The magic_quotes entry disappeared along with FILTER_SANITIZE_MAGIC_QUOTES; the add_slashes name replaces it.
filter_list() returns a flat array of filter names — strings such as int, validate_email, special_chars and callback. It takes no arguments and never fails.
When to reach for it
Two jobs. The first is discovery: run it once to see exactly which filters the PHP you are actually deploying to supports, rather than guessing from the manual. The second is validation of configuration — if your app lets a schema, admin UI or config file name a filter, check the name against filter_list() before handing it to filter_id(), so a typo produces a clear error instead of a silently skipped rule.
It also pairs naturally with filter_id() to build a name-to-constant lookup table for a form builder or rule engine.
What trips people up
The array keys are ordinary sequential integers, not filter IDs. Reading filter_list()[0] and expecting FILTER_VALIDATE_INT gives you the string "int". Convert names to IDs with filter_id().
The names also do not mirror the constant names. FILTER_VALIDATE_INT is listed as int, FILTER_VALIDATE_BOOL as boolean, and FILTER_SANITIZE_FULL_SPECIAL_CHARS as full_special_chars. Deprecated filters such as string are still listed while they remain callable.
Example
When to use it
- Print the supported filters once on a new server to confirm which ones the build actually has.
- Validate a filter name coming from a config file or admin UI before passing it to filter_id().
- Generate a name-to-ID reference table for a rule engine or form builder.
Frequently asked questions
Do the array keys from filter_list correspond to filter IDs?
No. They are plain sequential indexes starting at 0. Pass the name to filter_id() to get the ID that filter_var() and filter_input() accept.
Why is FILTER_VALIDATE_INT missing from filter_list?
It is there, under the name int. Only the non-numeric validators carry the validate_ prefix, so you will see int, boolean and float rather than validate_int, validate_bool and validate_float.
Does filter_list include deprecated filters?
Yes. Names such as string and stripped still appear while the filters remain callable, even though they are deprecated as of PHP 8.1 in favour of htmlspecialchars().
More examples
Building a name to ID table
Each line pairs a filter name with the integer that <code>filter_var()</code> expects, so you can see at a glance that <code>int</code> and <code>validate_email</code> are validators in the 257+ range while the sanitizers start higher. Every name returned by filter_list is guaranteed to resolve, so filter_id never returns false here.
<?php
foreach (filter_list() as $name) {
printf("%-22s %d\n", $name, filter_id($name));
}Validating a filter name from configuration
The first two names resolve to their IDs; <code>validate_phone</code> prints the error branch because no such filter exists. Checking against filter_list first turns a config typo into a message you can act on instead of a filter that quietly never runs.
<?php
$configured = ['validate_email', 'special_chars', 'validate_phone'];
$available = filter_list();
foreach ($configured as $name) {
if (in_array($name, $available, true)) {
echo "$name -> ", filter_id($name), "\n";
} else {
echo "$name is not a supported filter\n";
}
}
Discussion