\Zend\EscaperEscaper

Context specific methods for use in secure output escaping

Summary

Methods

Properties

Constants

__construct()
getEncoding()
escapeHtml()
escapeHtmlAttr()
escapeJs()
escapeUrl()
escapeCss()

No public properties found

No constants found

htmlAttrMatcher()
jsMatcher()
cssMatcher()
toUtf8()
fromUtf8()
isUtf8()
convertEncoding()

$htmlNamedEntityMap
$encoding
$htmlSpecialCharsFlags
$htmlAttrMatcher
$jsMatcher
$cssMatcher
$supportedEncodings

N/A

No private methods found

No private properties found

N/A

File: src/System/ThirdParty/ZendEscaper/Escaper.php
Package: Default
Class hierarchy: \Zend\Escaper\Escaper

Properties

$htmlNamedEntityMap

$htmlNamedEntityMap : array

Entity Map mapping Unicode codepoints to any available named HTML entities.

While HTML supports far more named entities, the lowest common denominator has become HTML5's XML Serialisation which is restricted to the those named entities that XML supports. Using HTML entities would result in this error: XML Parsing Error: undefined entity

Type

array

$encoding

$encoding : string

Current encoding for escaping. If not UTF-8, we convert strings from this encoding pre-escaping and back to this encoding post-escaping.

Type

string

$htmlSpecialCharsFlags

$htmlSpecialCharsFlags : integer

Holds the value of the special flags passed as second parameter to htmlspecialchars().

Type

integer

$htmlAttrMatcher

$htmlAttrMatcher : callable

Static Matcher which escapes characters for HTML Attribute contexts

Type

callable

$jsMatcher

$jsMatcher : callable

Static Matcher which escapes characters for Javascript contexts

Type

callable

$cssMatcher

$cssMatcher : callable

Static Matcher which escapes characters for CSS Attribute contexts

Type

callable

$supportedEncodings

$supportedEncodings : array

List of all encoding supported by this class

Type

array

Methods

__construct()

__construct(string  $encoding = null)

Constructor: Single parameter allows setting of global encoding for use by the current object.

Parameters

string

$encoding

Throws

\Zend\Escaper\Exception\InvalidArgumentException

getEncoding()

getEncoding() : string

Return the encoding that all output/input is expected to be encoded in.

Returns

string

escapeHtml()

escapeHtml(string  $string) : string

Escape a string for the HTML Body context where there are very few characters of special meaning. Internally this will use htmlspecialchars().

Parameters

string

$string

Returns

string

escapeHtmlAttr()

escapeHtmlAttr(string  $string) : string

Escape a string for the HTML Attribute context. We use an extended set of characters to escape that are not covered by htmlspecialchars() to cover cases where an attribute might be unquoted or quoted illegally (e.g. backticks are valid quotes for IE).

Parameters

string

$string

Returns

string

escapeJs()

escapeJs(string  $string) : string

Escape a string for the Javascript context. This does not use json_encode(). An extended set of characters are escaped beyond ECMAScript's rules for Javascript literal string escaping in order to prevent misinterpretation of Javascript as HTML leading to the injection of special characters and entities. The escaping used should be tolerant of cases where HTML escaping was not applied on top of Javascript escaping correctly.

Backslash escaping is not used as it still leaves the escaped character as-is and so is not useful in a HTML context.

Parameters

string

$string

Returns

string

escapeUrl()

escapeUrl(string  $string) : string

Escape a string for the URI or Parameter contexts. This should not be used to escape an entire URI - only a subcomponent being inserted. The function is a simple proxy to rawurlencode() which now implements RFC 3986 since PHP 5.3 completely.

Parameters

string

$string

Returns

string

escapeCss()

escapeCss(string  $string) : string

Escape a string for the CSS context. CSS escaping can be applied to any string being inserted into CSS and escapes everything except alphanumerics.

Parameters

string

$string

Returns

string

htmlAttrMatcher()

htmlAttrMatcher(array  $matches) : string

Callback function for preg_replace_callback that applies HTML Attribute escaping to all matches.

Parameters

array

$matches

Returns

string

jsMatcher()

jsMatcher(array  $matches) : string

Callback function for preg_replace_callback that applies Javascript escaping to all matches.

Parameters

array

$matches

Returns

string

cssMatcher()

cssMatcher(array  $matches) : string

Callback function for preg_replace_callback that applies CSS escaping to all matches.

Parameters

array

$matches

Returns

string

toUtf8()

toUtf8(string  $string) : string

Converts a string to UTF-8 from the base encoding. The base encoding is set via this class' constructor.

Parameters

string

$string

Throws

\Zend\Escaper\Exception\RuntimeException

Returns

string

fromUtf8()

fromUtf8(string  $string) : string

Converts a string from UTF-8 to the base encoding. The base encoding is set via this class' constructor.

Parameters

string

$string

Returns

string

isUtf8()

isUtf8(string  $string) : boolean

Checks if a given string appears to be valid UTF-8 or not.

Parameters

string

$string

Returns

boolean

convertEncoding()

convertEncoding(string  $string, string  $to, array|string  $from) : string

Encoding conversion helper which wraps iconv and mbstring where they exist or throws and exception where neither is available.

Parameters

string	$string
string	$to
array\|string	$from

Throws

\Zend\Escaper\Exception\RuntimeException

Returns

string