Framework Docs Validation

Validation

The Validator class provides a chainable validation pipeline for incoming form data and a sanitizer for cleaning untrusted input before use.

Namespace: Wojo\Core\Validator

Running Validation

Method Signature Description
run() static run(array $raw): static Start a validation chain with a raw input array
sanitize() static sanitize(mixed $data, SanitizeType $type, int $maxLen = 0): mixed Clean a single value using a sanitized type
cleanOut() static cleanOut(mixed $data): mixed Strip HTML tags and encode special chars
truncate() static truncate(string $data, int $length, bool $ellipsis = true): string Truncate a string to max length
trimToWords() static trimToWords(string $text, int $maxWords, string $suffix = '...'): string Trim to a maximum word count

Validation Rules

Chain rule methods after run() . Each rule method returns the same Validator instance for fluent chaining.

Rule Description
set(string $field, string $label) Point to the field to validate next
required(string $msg = '') Field must be non-empty
string() Must be a plain string
email() Must be a valid e-mail address
alpha() Letters only
alpha_numeric() Letters and digits only
numeric() Numeric characters only
integer() Must be an integer
float() Must be a float
boolean() Must be truthy/falsy
min_len(int) Minimum string length
max_len(int) Maximum string length
exact_len(int) Exact string length
min_numeric(float) Minimum numeric value
max_numeric(float) Maximum numeric value
equals(string $field) Must equal another field (e.g., password confirmation)
date() / time() Must be a valid date / time string
url() Must be a valid URL
color() Must be a valid hex color
phone() Must be a valid phone number format
json() Must be valid JSON
array() Must be an array
contains(string $needle) Must contain a substring
lowercase() / uppercase() Must be all lower / upper case
safe() Strip XSS-dangerous content
one(array $values) Must be one of the provided values
Show More

SanitizeType Enum

Pass a SanitizeType case to Validator::sanitize() :

Case Description
STRING Generic string — strip tags, encode entities
EMAIL Filter for valid e-mail characters
URL Filter for valid URL characters
ALPHA / ALPHALOW / ALPHAHI Letters only / lower / upper
ALPHANUMERIC Letters and digits
INT / FLOAT Integer / floating-point number
DATE / TIME / YEAR Date / time / four-digit year
FILE Safe filename (strip special chars)
TEXT Allows basic HTML tags, encodes entities
SEARCH Safe for a database LIKE query
DB / QUERY Database-safe strings

Example

PHP 
$v = Validator::run($_POST)
    ->set('email', 'Email')->required()->email()
    ->set('username', 'Username')->required()->alpha_numeric()->min_len(3)->max_len(32)
    ->set('password', 'Password')->required()->min_len(8)
    ->set('confirm', 'Confirm Password')->required()->equals('password');

if (!$v->isValid()) {
    // $v->getErrors() returns an array of error messages
    Response::error('Validation failed', data: $v->getErrors());
    exit;
}

// Sanitize individual fields after validation passes. It's not necessary, but it's a good idea.
$email    = Validator::sanitize($_POST['email'], SanitizeType::EMAIL);
$username = Validator::sanitize($_POST['username'], SanitizeType::ALPHANUMERIC, 32);