CODEWITHSUNDEEP
phpzend-framework2xss
Agent Smith
Agent Smith

Reputation: 97

Input filter/val output escape zf2 correctly?

Do I correctly understand, that I need to escape in view smth like this: 

 <div id="search-box">
        <?php $escaper = new Zend\Escaper\Escaper('utf-8'); ?>
        <input type="text" placeholder="<?php echo $escaper->escapeHtml($this->languageText('TEXT_SEARCH_OUR_SITE',"Search Our Site"));
       ?>" name="query" id="query" />
        <div class="search-box-bk"></div>
    </div>

And how correctly filter, or validate in controller this line:

$this->view->phrase = $this->getRequest()->getParam('phrase','');

Upvotes: 1

Views: 94

Answers (1)

Tim Fountain
Tim Fountain

Reputation: 33148

How to escape something correctly depends on the context. In your example the variable is being output in a HTML attribute, so you should use escapeHtmlAttr:

<input type="text" placeholder="<?php echo $escaper->escapeHtmlAttr($this->languageText('TEXT_SEARCH_OUR_SITE',"Search Our Site"));
   ?>" name="query" id="query" />

There is a list of escape functions in the overview of the component.

As for what you need to do in the controller, the answer is: probably nothing, but it depends what you are going to use "phrase" for.

Upvotes: 1

Related Questions