{$title}
++ {$heidelpay_iframe} +
+
User controlled CSS needs to be properly escaped!
- - -``` - -In the above example, by failing to escape the user provided CSS, an attacker -can execute an XSS attack fairly easily. - -## Example of Good CSS Escaping - -By using `escapeCss()` method in the CSS context, such attacks can be prevented: - -```php - - -'); -} -INPUT; - -$escaper = new Zend\Escaper\Escaper('utf-8'); -$output = $escaper->escapeCss($input); -?> - - -User controlled CSS needs to be properly escaped!
- - -``` - -By properly escaping user controlled CSS, we can prevent XSS attacks in our web -applications. diff --git a/vendor/zendframework/zend-escaper/doc/book/escaping-html-attributes.md b/vendor/zendframework/zend-escaper/doc/book/escaping-html-attributes.md deleted file mode 100644 index d498779..0000000 --- a/vendor/zendframework/zend-escaper/doc/book/escaping-html-attributes.md +++ /dev/null @@ -1,128 +0,0 @@ -# Escaping HTML Attributes - -Escaping data in **HTML Attribute** contexts is most often done incorrectly, if -not overlooked completely by developers. Regular [HTML -escaping](escaping-html.md) can be used for escaping HTML attributes *only* if -the attribute value can be **guaranteed as being properly quoted**! To avoid -confusion, we recommend always using the HTML Attribute escaper method when -dealing with HTTP attributes specifically. - -To escape data for an HTML Attribute, use `Zend\Escaper\Escaper`'s -`escapeHtmlAttr()` method. Internally it will convert the data to UTF-8, check -for its validity, and use an extended set of characters to escape that are not -covered by `htmlspecialchars()` to cover the cases where an attribute might be -unquoted or quoted illegally. - -## Examples of Bad HTML Attribute Escaping - -An example of incorrect HTML attribute escaping: - -```php - - - - - -json_encode() is not good for escaping javascript!
- - -``` - -The above example will show an alert popup box as soon as the page is loaded, -because the data is not properly escaped for the Javascript context. - -## Example of Good Javascript Escaping - -By using the `escapeJs()` method in the Javascript context, such attacks can be -prevented: - -```php - - -escapeJs($input); -?> - - -Zend\Escaper\Escaper::escapeJs() is good for escaping javascript!
- - -``` - -In the above example, the Javascript parser will most likely report a -`SyntaxError`, but at least the targeted application remains safe from such -attacks. diff --git a/vendor/zendframework/zend-escaper/doc/book/escaping-url.md b/vendor/zendframework/zend-escaper/doc/book/escaping-url.md deleted file mode 100644 index 4dc13e1..0000000 --- a/vendor/zendframework/zend-escaper/doc/book/escaping-url.md +++ /dev/null @@ -1,57 +0,0 @@ -# Escaping URLs - -This method is basically an alias for PHP's `rawurlencode()` which has applied -RFC 3986 since PHP 5.3. It is included primarily for consistency. - -URL escaping applies to data being inserted into a URL and not to the whole URL -itself. - -## Example of Bad URL Escaping - -XSS attacks are easy if data inserted into URLs is not escaped properly: - -```php - - - - - -Securely and safely escape HTML, HTML attributes, JavaScript, CSS, and URLs.
- -$ composer require zendframework/zend-escaper
-