- Getting Started
- Basic Usage
Cross-Site Scripting (XSS) Security
This page is not comprehensive and should not be considered a complete guide to XSS prevention.
The first step to preventing XSS attacks is knowing when you need to protect yourself. XSS can only be triggered when it is displayed within HTML content, sometimes via a form input or being displayed from database results. Any global variable that contains client information can be tainted. This includes
There are a few simple rules to follow to guard your application HTML against XSS. The first is to use the Security::xss method to clean any input data that comes from a global variable. If you do not want HTML in a variable, use strip_tags to remove all unwanted HTML tags from a value.
The second is to always escape data when inserting into HTML. The HTML class provides generators for many common tags, including script and stylesheet links, anchors, images, and email (mailto) links. Any untrusted content should be escaped using HTML::chars.