Download the PHP package thisispiers/xss-escape without Composer
On this page you can find all versions of the php package thisispiers/xss-escape. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download thisispiers/xss-escape
More information about thisispiers/xss-escape
Files in thisispiers/xss-escape
Package xss-escape
Short Description A PHP implementation of OWASP Cross Site Scripting Prevention Cheat Sheet
License LGPL-3.0-only
Informations about the package xss-escape
\thisispiers\Xss\Escape
A PHP implementation of OWASP's Cross Site Scripting Prevention Cheat Sheet
Released under LGPL v3.0. Requires PHP >= 7.1 and mbstring extension
Install with Composer composer require thisispiers/xss-escape
Usage
Untrusted data should be encoded differently depending on context. This library provides a static method for each context.
Text in HTML Body
i.e. <span>UNTRUSTED DATA</span>
$untrusted_data
is cast to string
HTML in HTML body
i.e. <div>UNTRUSTED HTML</div>
Use a full HTML validator in this context, such as HTML Purifier or DOMPurify
Safe HTML attributes
i.e. <input type="text" name="field_name" value="UNTRUSTED DATA">
$attr
must be one of
- align
- alink
- alt
- bgcolor
- border
- cellpadding
- cellspacing
- class
- color
- cols
- colspan
- coords
- dir
- face
- height
- href (see URLs)
- hspace
- ismap
- lang
- marginheight
- marginwidth
- multiple
- nohref
- noresize
- noshade
- nowrap
- ref
- rel
- rev
- rows
- rowspan
- scrolling
- shape
- span
- src (see URLs)
- summary
- tabindex
- title
- usemap
- valign
- value
- vlink
- vspace
- width
$untrusted_data
is cast to string
If $wrap
is true
, the returned string is prefixed by a space, the attribute name, an equal sign and wrapped in double quote marks i.e. value="ENCODED DATA"
.
URLs
URLs in src
or href
HTML attributes i.e. <iframe src="UNTRUSTED URL" />
or <a href="UNTRUSTED URL">link</a>
$untrusted_data
is cast to string
Untrusted URLs are currently only checked to be HTTPS. This is a crude check to avoid becoming a full URL parsing library. It is highly recommended that you run more sophisticated validation on your untrusted URLs, such as rejecting URLs by hostname.
JavaScript variables
i.e. <script>var someValue='UNTRUSTED DATA';</script>
or <script>someFunction('UNTRUSTED DATA');</script>
$untrusted_data
is cast to string
CSS values
i.e. <div style="width: UNTRUSTED DATA;">
$untrusted_data
is cast to string
URL parameters
i.e. <a href="/site/search?value=UNTRUSTED DATA">link</a>
$untrusted_data
is cast to string
JSON in HTML
$untrusted_data
is cast to string
Output JSON inside a hidden element before calling JSON.parse
e.g.
Contributing & Help
Don't expect frequent updates, but pull requests for security and performance improvements are welcome!
There is no guarantee this library complies with the latest OWASP cheat sheet recommendations. Create an issue if you think it's out of date, or start a pull request.
To save keystrokes, you might want to create an alias for this class
e.g. class_alias('\\thisispiers\Xss\\Escape', '\\esc');
All versions of xss-escape with dependencies
ext-mbstring Version *