 |
Zend Framework 2 Documentation (Manual) |  |
|
| Size: | 12675 |
| Storage flags: | no_autoload,compress/gzip (26%) |
This method is basically an alias for PHP’s rawurlencode() which has applied RFC 3986 since PHP 5.3. It is included primarily for consistency.
URL escaping applies to data being inserted into a URL and not to the whole URL itself.
XSS attacks are easy if data inserted into URLs is not escaped properly:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | <?php header('Content-Type: application/xhtml+xml; charset=UTF-8'); ?>
<!DOCTYPE html>
<?php
$input = <<<INPUT
" onmouseover="alert('zf2')
INPUT;
?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Unescaped URL data</title>
<meta charset="UTF-8"/>
</head>
<body>
<a href="http://example.com/?name=<?php echo $input; ?>">Click here!</a>
</body>
</html>
|
By properly escaping data in URLs by using escapeUrl, we can prevent XSS attacks:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | <?php header('Content-Type: application/xhtml+xml; charset=UTF-8'); ?>
<!DOCTYPE html>
<?php
$input = <<<INPUT
" onmouseover="alert('zf2')
INPUT;
$escaper = new Zend\Escaper\Escaper('utf-8');
$output = $escaper->escapeUrl($input);
?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Unescaped URL data</title>
<meta charset="UTF-8"/>
</head>
<body>
<a href="http://example.com/?name=<?php echo $output; ?>">Click here!</a>
</body>
</html>
|
Escaping Cascading Style Sheets
Note: You need to stay logged into your GitHub account to contribute to the documentation.
The source code of this file is hosted on GitHub. Everyone can update and fix errors in this document with few clicks - no downloads needed.