Class Escaper

Summary

Fully Qualified Name: Zend\Escaper\Escaper

Description

Context specific methods for use in secure output escaping

Methods

Name Description Defined By
__construct() Constructor: Single parameter allows setting of global encoding for use by the current object. Escaper
escapeCss() Escape a string for the CSS context. CSS escaping can be applied to any string being inserted into CSS and escapes everything except alphanumerics. Escaper
escapeHtml() Escape a string for the HTML Body context where there are very few characters of special meaning. Internally this will use htmlspecialchars(). Escaper
escapeHtmlAttr() Escape a string for the HTML Attribute context. We use an extended set of characters to escape that are not covered by htmlspecialchars() to cover cases where an attribute might be unquoted or quoted illegally (e.g. backticks are valid quotes for IE). Escaper
escapeJs() Escape a string for the Javascript context. This does not use json_encode(). An extended set of characters are escaped beyond ECMAScript's rules for Javascript literal string escaping in order to prevent misinterpretation of Javascript as HTML leading to the injection of special characters and entities. The escaping used should be tolerant of cases where HTML escaping was not applied on top of Javascript escaping correctly. Escaper
escapeUrl() Escape a string for the URI or Parameter contexts. This should not be used to escape an entire URI - only a subcomponent being inserted. The function is a simple proxy to rawurlencode() which now implements RFC 3986 since PHP 5.3 completely. Escaper
getEncoding() Return the encoding that all output/input is expected to be encoded in. Escaper

Method Details

__construct()

Constructor: Single parameter allows setting of global encoding for use by the current object.

Parameter Name Type Description
$encoding string

Returns:

escapeCss()

Escape a string for the CSS context. CSS escaping can be applied to any string being inserted into CSS and escapes everything except alphanumerics.

Parameter Name Type Description
$string string

Returns: string

escapeHtml()

Escape a string for the HTML Body context where there are very few characters of special meaning. Internally this will use htmlspecialchars().

Parameter Name Type Description
$string string

Returns: string

escapeHtmlAttr()

Escape a string for the HTML Attribute context. We use an extended set of characters to escape that are not covered by htmlspecialchars() to cover cases where an attribute might be unquoted or quoted illegally (e.g. backticks are valid quotes for IE).

Parameter Name Type Description
$string string

Returns: string

escapeJs()

Escape a string for the Javascript context. This does not use json_encode(). An extended set of characters are escaped beyond ECMAScript's rules for Javascript literal string escaping in order to prevent misinterpretation of Javascript as HTML leading to the injection of special characters and entities. The escaping used should be tolerant of cases where HTML escaping was not applied on top of Javascript escaping correctly.

Backslash escaping is not used as it still leaves the escaped character as-is and so is not useful in a HTML context.

Parameter Name Type Description
$string string

Returns: string

escapeUrl()

Escape a string for the URI or Parameter contexts. This should not be used to escape an entire URI - only a subcomponent being inserted. The function is a simple proxy to rawurlencode() which now implements RFC 3986 since PHP 5.3 completely.

Parameter Name Type Description
$string string

Returns: string

getEncoding()

Return the encoding that all output/input is expected to be encoded in.

Returns: string

Top