Define the input contract before choosing a function
Name the input owner, source, maximum length, allowed byte or character set, complete shape, delimiter, field count and permitted downstream use. Caller identity, SIP headers, DTMF, database values and HTTP responses cross different trust boundaries even when they become ordinary channel variables.
Validate once, store the accepted result in a new variable and branch explicitly on rejection. A value that is printable, non-empty or successfully split is not automatically safe as a dial string, context, application, file path, SQL fragment, shell argument or URL.
Separate absence and length from semantic validity
ISNULL(data) reports whether a value is null, while LEN(string) reports its length. Use those as presence and size observations before interpreting content, and keep a required empty value distinct from a missing upstream assignment when the source can expose that distinction.
Neither function proves provenance, character set or business meaning. Record a bounded length and a non-sensitive classification rather than logging raw credentials, telephone numbers or headers.
Use FILTER as transformation, not silent validation
FILTER(allowed-chars,string) returns only characters listed or included in its configured ranges. The documentation also defines hexadecimal, octal and tab, newline or carriage-return forms and requires an escaped hyphen when the hyphen itself is allowed.
Because disallowed characters are removed, the result can be a different but still plausible value. Compare the original with the filtered candidate and reject or handle the mismatch deliberately; do not silently route a changed account, destination or identifier.
Make REGEX prove the complete shape you require
REGEX("regular expression" string) returns 1 for a match and 0 otherwise. Express the whole accepted shape, including start and end boundaries where the contract requires a full-string match, and test the exact escaping that survives dialplan parsing.
The current syntax has a special separator rule: one space after the quoted expression is skipped, while two are needed when the data itself must begin with a space. Preserve the actual pattern and redacted input class when diagnosing an unexpected branch.
Count fields before CUT and preserve variable-name semantics
FIELDQTY(varname,delim) counts fields in the named variable; the reviewed implementation returns zero for an empty value when a delimiter is supplied. CUT(varname,char-delim,range-spec) also expects a variable name rather than an already expanded variable expression, and its field positions are one based.
Freeze the source variable, delimiter, expected count and selected range before extraction. A delimiter inside unescaped data, a missing field and an empty field are different conditions; field count and extracted content must both be validated.
Exercise rejection and parser boundaries in staging
For an authorized staging case, record the installed branch, loaded function help, dialplan revision, input source, raw length, filtered-equality result, regex result, delimiter, field count, selected range, accepted value classification and next priority. Exercise empty, shortest valid, longest valid, one disallowed character, leading or trailing whitespace, extra delimiter, missing field and empty-field cases.
Verify the downstream application separately and remove temporary logging. No PBX, module, dialplan, channel, variable, external input, parsed field, route, packet, media stream or live call was inspected or tested; this guide is documentation-derived.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- Asterisk FILTER dialplan function ↗
- Asterisk REGEX dialplan function ↗
- Asterisk ISNULL dialplan function ↗
- Asterisk LEN dialplan function ↗
- Asterisk FIELDQTY dialplan function ↗
- Asterisk CUT dialplan function ↗
- Asterisk dialplan-functions overview ↗
- Asterisk func_strings implementation ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.