Skip to content

Commit 203e07a

Browse files
author
=
committed
First commit
1 parent a1b77a6 commit 203e07a

File tree

11 files changed

+638
-1
lines changed

11 files changed

+638
-1
lines changed

‎.gitattributes

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.gitignore export-ignore
2+
.gitattributes export-ignore
3+
/Examples export-ignore

‎.gitignore

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
/.idea/
2+
/.vscode/
3+
/.vs/
4+
/vendor/
5+
/composer.lock

‎Examples/Attr.php

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?php
2+
require_once "../vendor/autoload.php";
3+
use \InitPHP\Escaper\Esc;
4+
5+
$input = 'faketitle onmouseover=alert(/InitPHP!/);';
6+
?>
7+
<!DOCTYPE html>
8+
<html>
9+
<head>
10+
<title>Quoteless Attribute</title>
11+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
12+
</head>
13+
<body>
14+
<div>
15+
<?php
16+
// <span title=faketitle&#x20;onmouseover&#x3D;alert&#x28;&#x2F;InitPHP&#x21;&#x2F;&#x29;&#x3B;>
17+
?>
18+
<span title=<?php echo Esc::esc($input, 'attr'); ?>>
19+
Hello World
20+
</span>
21+
</div>
22+
</body>
23+
</html>

‎Examples/Css.php

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<?php
2+
require_once "../vendor/autoload.php";
3+
use \InitPHP\Escaper\Esc;
4+
5+
$input = <<<INPUT
6+
body {
7+
background-image: url('http://example.com/bar.jpg?</style><script>alert(13)</script>');
8+
}
9+
INPUT;
10+
?>
11+
<!DOCTYPE html>
12+
<html xmlns="http://www.w3.org/1999/xhtml">
13+
<head>
14+
<title>Escaped CSS</title>
15+
<meta charset="UTF-8"/>
16+
<style>
17+
<?php
18+
/**
19+
* body\20 \7B \D \A \20 \20 \20 \20 background\2D image\3A \20 url\28 \27 http\3A \2F \2F example\2E com\2F bar\2E jpg\3F \3C \2F style\3E \3C script\3E alert\28 13\29 \3C \2F script\3E \27 \29 \3B \D \A \7D
20+
*/
21+
echo Esc::esc($input, 'css');
22+
?>
23+
</style>
24+
</head>
25+
<body>
26+
<p>User controlled CSS needs to be properly escaped!</p>
27+
</body>
28+
</html>

‎Examples/Html.php

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<?php
2+
require_once "../vendor/autoload.php";
3+
use \InitPHP\Escaper\Esc;
4+
?>
5+
<!DOCTYPE html>
6+
<html>
7+
<head>
8+
<title>Encodings set correctly!</title>
9+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
10+
</head>
11+
<body>
12+
<?php
13+
14+
$input = '<script>alert("initphp")</script>';
15+
16+
// &lt;script&gt;alert(&quot;initphp&quot;)&lt;/script&gt;
17+
echo Esc::esc($input, 'html');
18+
19+
?>
20+
</body></html>

‎Examples/Js.php

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<?php
2+
require_once "../vendor/autoload.php";
3+
use InitPHP\Escaper\Esc;
4+
5+
$input = 'bar&quot;; alert(&quot;Hello!&quot;); var xss=&quot;true';
6+
?>
7+
<!DOCTYPE html>
8+
<html xmlns="http://www.w3.org/1999/xhtml">
9+
<head>
10+
<title>Escaped Entities</title>
11+
<meta charset="UTF-8"/>
12+
<script type="text/javascript">
13+
<?php
14+
/**
15+
* var foo = bar\x26quot\x3B\x3B\x20alert\x28\x26quot\x3BHello\x21\x26quot\x3B\x29\x3B\x20var\x20xss\x3D\x26quot\x3Btrue;
16+
*/
17+
?>
18+
var foo = <?php echo Esc::esc($input, 'js'); ?>;
19+
</script>
20+
</head>
21+
<body>
22+
<p>Hello World</p>
23+
</body>
24+
</html>

‎Examples/Url.php

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?php
2+
require_once "../vendor/autoload.php";
3+
use \InitPHP\Escaper\Esc;
4+
5+
$query = <<<QUERY
6+
" onmouseover="alert('hello')
7+
QUERY;
8+
?>
9+
<!DOCTYPE html>
10+
<html xmlns="http://www.w3.org/1999/xhtml">
11+
<head>
12+
<title>Unescaped URL data</title>
13+
<meta charset="UTF-8"/>
14+
</head>
15+
<body>
16+
<?php
17+
// http://example.com/?query=%22%20onmouseover%3D%22alert%28%27hello%27%29
18+
?>
19+
<a href="http://example.com/?query=<?php echo Esc::esc($query, 'url'); ?>">Click here!</a>
20+
</body>
21+
</html>

‎README.md

Lines changed: 180 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,180 @@
1-
# Escaper
1+
# InitPHP Escaper
2+
3+
Securely and safely escape HTML, HTML attributes, JavaScript, CSS, and URLs.
4+
5+
[![Latest Stable Version](http://poser.pugx.org/initphp/escaper/v)](https://packagist.org/packages/initphp/escaper) [![Total Downloads](http://poser.pugx.org/initphp/escaper/downloads)](https://packagist.org/packages/initphp/escaper) [![Latest Unstable Version](http://poser.pugx.org/initphp/escaper/v/unstable)](https://packagist.org/packages/initphp/escaper) [![License](http://poser.pugx.org/initphp/escaper/license)](https://packagist.org/packages/initphp/escaper) [![PHP Version Require](http://poser.pugx.org/initphp/escaper/require/php)](https://packagist.org/packages/initphp/escaper)
6+
7+
## Requirements
8+
9+
- PHP 7.4 or higher
10+
- PHP _CType_ Extension
11+
- PHP _MB_String_ or _Iconv_ Extension
12+
13+
## Installation
14+
15+
```php
16+
composer require initphp/escaper
17+
```
18+
19+
## Usage
20+
21+
`\InitPHP\Escaper\Esc::esc()` :
22+
23+
```php
24+
public static function esc(string[]|string $data, string $context = 'html', ?string $encoding = null): array|string;
25+
```
26+
27+
- `$data` : The content to be cleared.
28+
- `$context` : The method to be used for cleaning. If the value is not one of the following; Throws `Exception`.
29+
- `html`
30+
- `js`
31+
- `css`
32+
- `url`
33+
- `attr`
34+
- `$encoding` : If the character set to be used is not specified or `NULL`; `UTF-8` is used by default.
35+
36+
`html` Escaper Example :
37+
```php
38+
<?php
39+
require_once "vendor/autoload.php";
40+
use \InitPHP\Escaper\Esc;
41+
42+
$input = '<script>alert("initphp")</script>';
43+
?>
44+
<!DOCTYPE html>
45+
<html>
46+
<head>
47+
<title>Encodings set correctly!</title>
48+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
49+
</head>
50+
<body>
51+
52+
<?php
53+
echo Esc::esc($input, 'html');
54+
?>
55+
</body></html>
56+
```
57+
58+
`attr` Escaper Example :
59+
60+
```php
61+
<?php
62+
require_once "../vendor/autoload.php";
63+
use \InitPHP\Escaper\Esc;
64+
65+
$input = 'faketitle onmouseover=alert(/InitPHP!/);';
66+
?>
67+
<!DOCTYPE html>
68+
<html>
69+
<head>
70+
<title>Quoteless Attribute</title>
71+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
72+
</head>
73+
<body>
74+
<div>
75+
<?php
76+
// <span title=faketitle&#x20;onmouseover&#x3D;alert&#x28;&#x2F;InitPHP&#x21;&#x2F;&#x29;&#x3B;>
77+
?>
78+
<span title=<?php echo Esc::esc($input, 'attr'); ?>>
79+
Hello World
80+
</span>
81+
</div>
82+
</body>
83+
</html>
84+
```
85+
86+
`Js` Escaper Example :
87+
88+
```php
89+
<?php
90+
require_once "../vendor/autoload.php";
91+
use InitPHP\Escaper\Esc;
92+
93+
$input = 'bar&quot;; alert(&quot;Hello!&quot;); var xss=&quot;true';
94+
?>
95+
<!DOCTYPE html>
96+
<html xmlns="http://www.w3.org/1999/xhtml">
97+
<head>
98+
<title>Escaped Entities</title>
99+
<meta charset="UTF-8"/>
100+
<script type="text/javascript">
101+
<?php
102+
/**
103+
* var foo = bar\x26quot\x3B\x3B\x20alert\x28\x26quot\x3BHello\x21\x26quot\x3B\x29\x3B\x20var\x20xss\x3D\x26quot\x3Btrue;
104+
*/
105+
?>
106+
var foo = <?php echo Esc::esc($input, 'js'); ?>;
107+
</script>
108+
</head>
109+
<body>
110+
<p>Hello World</p>
111+
</body>
112+
</html>
113+
```
114+
115+
`css` Escaper Example :
116+
117+
```php
118+
<?php
119+
require_once "../vendor/autoload.php";
120+
use \InitPHP\Escaper\Esc;
121+
122+
$input = <<<INPUT
123+
body {
124+
background-image: url('http://example.com/bar.jpg?</style><script>alert(13)</script>');
125+
}
126+
INPUT;
127+
?>
128+
<!DOCTYPE html>
129+
<html xmlns="http://www.w3.org/1999/xhtml">
130+
<head>
131+
<title>Escaped CSS</title>
132+
<meta charset="UTF-8"/>
133+
<style>
134+
<?php
135+
/**
136+
* body\20 \7B \D \A \20 \20 \20 \20 background\2D image\3A \20 url\28 \27 http\3A \2F \2F example\2E com\2F bar\2E jpg\3F \3C \2F style\3E \3C script\3E alert\28 13\29 \3C \2F script\3E \27 \29 \3B \D \A \7D
137+
*/
138+
echo Esc::esc($input, 'css');
139+
?>
140+
</style>
141+
</head>
142+
<body>
143+
<p>User controlled CSS needs to be properly escaped!</p>
144+
</body>
145+
</html>
146+
```
147+
148+
`url` Escaper Example :
149+
150+
```php
151+
<?php
152+
require_once "../vendor/autoload.php";
153+
use \InitPHP\Escaper\Esc;
154+
155+
$query = <<<QUERY
156+
" onmouseover="alert('hello')
157+
QUERY;
158+
?>
159+
<!DOCTYPE html>
160+
<html xmlns="http://www.w3.org/1999/xhtml">
161+
<head>
162+
<title>Unescaped URL</title>
163+
<meta charset="UTF-8"/>
164+
</head>
165+
<body>
166+
<?php
167+
// http://example.com/?query=%22%20onmouseover%3D%22alert%28%27hello%27%29
168+
?>
169+
<a href="http://example.com/?query=<?php echo Esc::esc($query, 'url'); ?>">Click</a>
170+
</body>
171+
</html>
172+
```
173+
174+
## Credits
175+
176+
- [Muhammet ŞAFAK](https://www.muhammetsafak.com.tr) <<info@muhammetsafak.com.tr>>
177+
178+
## License
179+
180+
Copyright &copy; 2022 [MIT License](./LICENSE)

‎composer.json

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"name": "initphp/escaper",
3+
"description": "InitPHP Escaper Class",
4+
"type": "library",
5+
"license": "MIT",
6+
"autoload": {
7+
"psr-4": {
8+
"InitPHP\\Escaper\\": "src/"
9+
}
10+
},
11+
"authors": [
12+
{
13+
"name": "Muhammet ŞAFAK",
14+
"email": "info@muhammetsafak.com.tr",
15+
"role": "Developer",
16+
"homepage": "https://www.muhammetsafak.com.tr"
17+
}
18+
],
19+
"minimum-stability": "stable",
20+
"require": {
21+
"php": ">=7.4",
22+
"ext-ctype": "*"
23+
}
24+
}

0 commit comments

Comments
 (0)