__construct()
escapeCss()
escapeHtml()
escapeHtmlAttr()
escapeJs()
escapeUrl()
getEncoding()
convertEncoding()
cssMatcher()
fromUtf8()
htmlAttrMatcher()
isUtf8()
jsMatcher()
toUtf8()
$cssMatcher
$encoding
$htmlAttrMatcher
$htmlNamedEntityMap
$htmlSpecialCharsFlags
$jsMatcher
$supportedEncodings
Context specific methods for use in secure output escaping
__construct(string $encoding)
If PHP 5.4 is detected, additional ENT_SUBSTITUTE flag is set for htmlspecialchars() calls.
string
\Zend\Escaper\Exception\InvalidArgumentException |
|---|
escapeCss(string $string) : string
CSS escaping can be applied to any string being inserted into CSS and escapes everything except alphanumerics.
string
stringescapeHtml(string $string) : string
Internally this will use htmlspecialchars().
string
stringescapeHtmlAttr(string $string) : string
We use an extended set of characters to escape that are not covered by htmlspecialchars() to cover cases where an attribute might be unquoted or quoted illegally (e.g. backticks are valid quotes for IE).
string
stringescapeJs(string $string) : string
This does not use json_encode(). An extended set of characters are escaped beyond ECMAScript's rules for Javascript literal string escaping in order to prevent misinterpretation of Javascript as HTML leading to the injection of special characters and entities. The escaping used should be tolerant of cases where HTML escaping was not applied on top of Javascript escaping correctly. Backslash escaping is not used as it still leaves the escaped character as-is and so is not useful in a HTML context.
string
stringescapeUrl(string $string) : string
This should not be used to escape an entire URI - only a subcomponent being inserted. The function is a simple proxy to rawurlencode() which now implements RFC 3986 since PHP 5.3 completely.
string
stringgetEncoding() : string
stringconvertEncoding(string $string, string $to, array | string $from) : string
string
string
arraystring
\Zend\Escaper\Exception\RuntimeException |
|---|
stringcssMatcher(array $matches) : string
array
stringfromUtf8(string $string) : string
The base encoding is set via this class' constructor.
string
stringhtmlAttrMatcher(array $matches) : string
array
stringisUtf8(string $string) : bool
string
booljsMatcher(array $matches) : string
array
stringtoUtf8(string $string) : string
The base encoding is set via this class' constructor.
string
\Zend\Escaper\Exception\RuntimeException |
|---|
string$cssMatcher : \Zend\Escaper\callable
$encoding : string
If not UTF-8, we convert strings from this encoding pre-escaping and back to this encoding post-escaping.
$htmlAttrMatcher : \Zend\Escaper\callable
$htmlNamedEntityMap : array
While HTML supports far more named entities, the lowest common denominator has become HTML5's XML Serialisation which is restricted to the those named entities that XML supports. Using HTML entities would result in this error: XML Parsing Error: undefined entity
$htmlSpecialCharsFlags : string
We modify these for PHP 5.4 to take advantage of the new ENT_SUBSTITUTE flag for correctly dealing with invalid UTF-8 sequences.
$jsMatcher : \Zend\Escaper\callable
$supportedEncodings : array