Mercurial > hg > isophonics-drupal-site

comparison vendor/zendframework/zend-escaper/doc/book/escaping-url.md @ 0:4c8ae668cc8c

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Initial import (non-working)
author Chris Cannam
date Wed, 29 Nov 2017 16:09:58 +0000
parents
children
comparison
equal deleted inserted replaced
-1:000000000000 0:4c8ae668cc8c
1 # Escaping URLs
2
3 This method is basically an alias for PHP's `rawurlencode()` which has applied
4 RFC 3986 since PHP 5.3. It is included primarily for consistency.
5
6 URL escaping applies to data being inserted into a URL and not to the whole URL
7 itself.
8
9 ## Example of Bad URL Escaping
10
11 XSS attacks are easy if data inserted into URLs is not escaped properly:
12
13 ```php
14 <?php header('Content-Type: application/xhtml+xml; charset=UTF-8'); ?>
15 <!DOCTYPE html>
16 <?php
17 $input = <<<INPUT
18 " onmouseover="alert('zf2')
19 INPUT;
20 ?>
21 <html xmlns="http://www.w3.org/1999/xhtml">
22 <head>
23 <title>Unescaped URL data</title>
24 <meta charset="UTF-8"/>
25 </head>
26 <body>
27 <a href="http://example.com/?name=<?= $input ?>">Click here!</a>
28 </body>
29 </html>
30 ```
31
32 ## Example of Good URL Escaping
33
34 By properly escaping data in URLs by using `escapeUrl()`, we can prevent XSS
35 attacks:
36
37 ```php
38 <?php header('Content-Type: application/xhtml+xml; charset=UTF-8'); ?>
39 <!DOCTYPE html>
40 <?php
41 $input = <<<INPUT
42 " onmouseover="alert('zf2')
43 INPUT;
44
45 $escaper = new Zend\Escaper\Escaper('utf-8');
46 $output = $escaper->escapeUrl($input);
47 ?>
48 <html xmlns="http://www.w3.org/1999/xhtml">
49 <head>
50 <title>Unescaped URL data</title>
51 <meta charset="UTF-8"/>
52 </head>
53 <body>
54 <a href="http://example.com/?name=<?= $output ?>">Click here!</a>
55 </body>
56 </html>
57 ```