Download the PHP package initphp/escaper without Composer
On this page you can find all versions of the php package initphp/escaper. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package escaper
initphp/escaper
Context-aware output escaper for PHP. Safely render untrusted user input inside HTML, HTML attributes, JavaScript, CSS and URLs.
htmlspecialchars() is not enough on its own. Each output context — an HTML
body, an attribute, a JavaScript string literal, a CSS value, a URL parameter
— needs its own escaping rules, and using the wrong one can leave you exposed
to XSS even when you think you have escaped your data.
initphp/escaper implements the rules from the
OWASP XSS Prevention Cheat Sheet
for the five most common contexts, behind a small, dependency-free API.
Installation
Requirements
- PHP 7.4 or newer
ext-ctypeext-mbstring(required);ext-iconvis used when present and preferred over mbstring
Quick start
Esc::esc() also accepts arrays and recurses into them, so escaping a whole
request payload at the view boundary is a one-liner:
API
Esc::esc()
| Argument | Description |
|---|---|
$data |
A string, or an array (which is escaped recursively). |
$context |
html, attr, js, css, url, or raw (returns input unchanged). |
$encoding |
Output encoding. null resolves to UTF-8. See Encodings. |
Throws InitPHP\Escaper\Exception\InvalidContextException for unknown contexts.
Escaper
For lower-level use, instantiate Escaper directly. Each instance is bound to
one encoding and exposes one method per context:
Documentation
The docs/ directory contains a per-context walkthrough with
examples, do-and-don't guidance and security notes:
- Getting started
- HTML body context
- HTML attribute context
- JavaScript context
- CSS context
- URL context
- Encodings
- Exceptions
- Security notes
A word of warning
Output escaping prevents XSS but it is not a substitute for input validation, authentication, or authorisation. It is also context-sensitive: the JavaScript escaper assumes the caller wraps the result in quotes, the HTML attribute escaper assumes the value is used as a single attribute value, and so on. Read the per-context docs before mixing contexts.
Contributing
Contributions are welcome. Please read the org-wide CONTRIBUTING guide for the workflow, coding standards and test expectations.
A typical loop is:
Individual steps are also available:
| Command | What it does |
|---|---|
composer test |
Run PHPUnit |
composer stan |
Run PHPStan (max level) |
composer cs-check |
Report PHP-CS-Fixer violations, no changes |
composer cs-fix |
Apply PHP-CS-Fixer changes |
Security
If you discover a security issue, please follow the disclosure process documented in SECURITY.md rather than opening a public issue.
License
Released under the MIT License. © InitPHP.
All versions of escaper with dependencies
ext-ctype Version *
ext-mbstring Version *