Sanitize HTML

The \Nullai\Hygiene\SanitizeHtml class offers methods for safely sanitizing HTML, attributes, and JSON data. These tools ensure that your application is protected against common injection vulnerabilities and XSS attacks.

​

Sanitizing HTML Content

The \Nullai\Hygiene\SanitizeHtml::escHtml() method escapes special characters in a string to ensure it is safe for rendering in an HTML context.

<aside class="sidebar">
    <nav class="menu">
        <ul>
            <li>
                <a href="#" title="<?= \Nullai\Hygiene\SanitizeHtml::escAttr($linkTitle) ?>">
                    <?= \Nullai\Hygiene\SanitizeHtml::escHtml($linkTitle) ?>
                </a>
            </li>
        </ul>
    </nav>
</aside>

​

Method Signatures

\Nullai\Hygiene\SanitizeHtml::escHtml(string $html): string

\Nullai\Hygiene\SanitizeHtml::escAttr(string $attribute): string

​

Sanitizing JSON Data

The \Nullai\Hygiene\SanitizeHtml::escJson() method sanitizes data and safely encodes it as JSON for embedding in JavaScript.

<script>
    // Safely embed JSON in a JavaScript variable
    console.log(<?= \Nullai\Hygiene\SanitizeHtml::escJson(['site' => '<My Site>']) ?>);
</script>

​

Method Signature

\Nullai\Hygiene\SanitizeHtml::escJson(mixed $data): string

​

Explanation

The escJson() method uses json_encode() with the following flags: JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_AMP, and JSON_HEX_QUOT:

• < as \u003C
• > as \u003E
• & as \u0026
• ' as \u0027
• " as \u0022

This hexadecimal escaping makes the encoded JSON safe for embedding directly into JavaScript, effectively preventing JavaScript injection attacks.

​

Common Use Cases

​

HTML and Attributes

• Escaping dynamic content displayed in HTML tags.
• Escaping data used in HTML attributes to prevent malicious injections.

​

JSON

• Embedding server-side data into client-side JavaScript securely.
• Generating JSON output that avoids breaking JavaScript execution due to unsafe characters.

​

Best Practices

1. Always Sanitize Input: Use escHtml() and escAttr() to ensure dynamic content is safely rendered in HTML.
2. Use Escaped JSON for JavaScript: Always sanitize and encode PHP data as JSON using escJson() before embedding in JavaScript.
3. Validate Before Sanitizing: Ensure input data conforms to expected formats before applying sanitization.

These methods from \Nullai\Hygiene\SanitizeHtml help ensure your application maintains robust defenses against XSS and injection vulnerabilities while simplifying safe handling of dynamic content.