Unescaped CSS

Chris@0: # Escaping Cascading Style Sheets Chris@0: Chris@0: CSS is similar to [escaping Javascript](escaping-javascript.md). CSS escaping Chris@0: excludes only basic alphanumeric characters and escapes all other characters Chris@0: into valid CSS hexadecimal escapes. Chris@0: Chris@0: ## Example of Bad CSS Escaping Chris@0: Chris@0: In most cases developers forget to escape CSS completely: Chris@0: Chris@0: ```php Chris@0: Chris@0: Chris@0: '); Chris@0: } Chris@0: INPUT; Chris@0: ?> Chris@0: Chris@0: Chris@0: Unescaped CSS Chris@0: Chris@0: Chris@0: Chris@0: Chris@0:

User controlled CSS needs to be properly escaped!

Chris@0: Chris@0: Chris@0: ``` Chris@0: Chris@0: In the above example, by failing to escape the user provided CSS, an attacker Chris@0: can execute an XSS attack fairly easily. Chris@0: Chris@0: ## Example of Good CSS Escaping Chris@0: Chris@0: By using `escapeCss()` method in the CSS context, such attacks can be prevented: Chris@0: Chris@0: ```php Chris@0: Chris@0: Chris@0: '); Chris@0: } Chris@0: INPUT; Chris@0: Chris@0: $escaper = new Zend\Escaper\Escaper('utf-8'); Chris@0: $output = $escaper->escapeCss($input); Chris@0: ?> Chris@0: Chris@0: Chris@0: Escaped CSS Chris@0: Chris@0: Chris@0: Chris@0: Chris@0:

User controlled CSS needs to be properly escaped!

Chris@0: Chris@0: Chris@0: ``` Chris@0: Chris@0: By properly escaping user controlled CSS, we can prevent XSS attacks in our web Chris@0: applications.