This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Category:OWASP PHP AntiXSS Library Project"

From OWASP
Jump to: navigation, search
Line 1: Line 1:
 
{{:Template:Orphaned Projects}}
 
{{:Template:Orphaned Projects}}
 +
 +
 +
==== Main  ====
  
 
== Introduction ==
 
== Introduction ==
Line 77: Line 80:
  
 
And particularly if you wish to output extended or multibyte characters from within your source files, make sure the encoding of all files involved matches the output format, unless you will be handling your conversions manually using mb_convert_encoding.
 
And particularly if you wish to output extended or multibyte characters from within your source files, make sure the encoding of all files involved matches the output format, unless you will be handling your conversions manually using mb_convert_encoding.
 +
 +
==== Project Identification ====
  
 
[[Category:OWASP Project|PHP AntiXSS Library Project]]
 
[[Category:OWASP Project|PHP AntiXSS Library Project]]
 +
 +
{{Template:OWASP Project Identification Tab
 +
| project_name = OWASP PHP AntiXSS Library Project
 +
| project_description =
 +
| leader_name =
 +
| leader_email =
 +
| leader_username =
 +
| maintainer_name =
 +
| maintainer_email =
 +
| maintainer_username =
 +
| contributor_name1 =
 +
| contributor_email1 =
 +
| contributor_username1 =
 +
| contributor_name2 =
 +
| contributor_email2 =
 +
| contributor_username2 =
 +
| contributor_name3 =
 +
| contributor_email3 =
 +
| contributor_username3 =
 +
| contributor_name4 =
 +
| contributor_email4 =
 +
| contributor_username4 =
 +
| contributor_name5 =
 +
| contributor_email5 =
 +
| contributor_username5 =
 +
| contributor_name6 =
 +
| contributor_email6 =
 +
| contributor_username6 =
 +
| contributor_name7 =
 +
| contributor_email7 =
 +
| contributor_username7 =
 +
| contributor_name8 =
 +
| contributor_email8 =
 +
| contributor_username8 =
 +
| contributor_name9 =
 +
| contributor_email9 =
 +
| contributor_username9 =
 +
| contributor_name10 =
 +
| contributor_email10 =
 +
| contributor_username10 = 
 +
| pamphlet_link =
 +
| mailing_list_name =
 +
| links_url1 =
 +
| links_name1 =
 +
| links_url2 =
 +
| links_name2 =
 +
| links_url3 =
 +
| links_name3 =
 +
| links_url4 =
 +
| links_name4 =
 +
| links_url5 =
 +
| links_name5 =
 +
| links_url6 =
 +
| links_name6 =
 +
| links_url7 =
 +
| links_name7 =
 +
| links_url8 =
 +
| links_name8 =
 +
| links_url9 =
 +
| links_name9 =
 +
| links_url10 =
 +
| links_name10 =
 +
| project_road_map =
 +
| project_health_status =
 +
| current_release_name =
 +
| current_release_date =
 +
| current_release_download_link =
 +
| current_release_rating =
 +
| current_release_leader_name =
 +
| current_release_leader_email =
 +
| current_release_leader_username =
 +
| last_reviewed_release_name =
 +
| last_reviewed_release_date =
 +
| last_reviewed_release_download_link =
 +
| last_reviewed_release_rating =
 +
| last_reviewed_release_leader_name =
 +
| last_reviewed_release_leader_email =
 +
| last_reviewed_release_leader_username =
 +
| old_release_name1 =
 +
| old_release_date1 =
 +
| old_release_download_link1 =
 +
| old_release_name2 =
 +
| old_release_date2 =
 +
| old_release_download_link2 =
 +
| old_release_name3 =
 +
| old_release_date3 =
 +
| old_release_download_link3 =
 +
| old_release_name4 =
 +
| old_release_date4 =
 +
| old_release_download_link4 =
 +
| old_release_name5 =
 +
| old_release_date5 =
 +
| old_release_download_link5 =
 +
}}
 +
__NOTOC__ <headertabs />

Revision as of 16:51, 24 August 2009

Attention icon.png

This Project has been identified as an orphaned one. If you find interest in assuming its lead, please contact the Global Projects Committee.

Attention icon.png


Main

Introduction

AntiXSS is a class for use with PHP 5+ that helps to reduce XSS (cross-site scripting) vulnerabilities by automatically encoding output to behave only as intended.

NOTE!!!

NOTE: This library will eventually replaced by the ESAPI for PHP port. That effort is not complete as yet. The actual API will not change dramatically between AntiXSS library and ESAPI for PHP.

Requirements

  • PHP5 and above
  • mb_string PHP extension

Usage

  1. Make sure the mb_string extension is available with your PHP installation. If you are using Apache on Windows, this can most likely be done by adding (or un-commenting) a line in your php.ini file. On other platforms, you may need to recompile PHP. See [1] for more information.
  2. To make the code available to your program, include the owasp.antixss.php file, using a line like this: require_once "/path/to/owasp.antixss.php";
  3. It is not necessary to instantiate the class, though you may if you wish. Instead, make calls using the Scope Resolution Operator (::), like this: echo AntiXSS::HTMLEncode($myOutput);

Examples

HTML

Hello, <php echo AntiXSS:HTMLEncode($nameOfMyUser); ?>!

JavaScript

... alert(myFunction('<?php echo AntiXSS:JavaScriptEncode($myVariable); ?>'); ...

URL

... http://example.com/myscript.php?<?php echo AntiXSS::URLEncode($myQueryStringValue); ?> ...

XML

<myelement myattribute="<?php echo AntiXSS::XMLAttributeEncode($myAttributeValue); ?>"><?php echo AntiXSS::XMLEncode($myElementValue); ?></myelement >

Downloads

Downloads are not yet available.

  • owasp.antixss.php
  • demo.owasp.antixss.php

Troubleshooting

Encoding

The AntiXSS class will use any character encoding supported by libmbfl, the library upon which the mbstring functions are based, with the exception of 7bit and BASE64.

A list of supported character sets is available at PHP.net: [2]

The Owasp AntiXSS class utilizes the following encodings: UTF-32, HTML-ENTITIES

Typically, your doctype definition will match the encoding of your source files and your database source. If you run into issues where some characters don't display or display wrong, check the encoding of every data source and file involved.

And particularly if you wish to output extended or multibyte characters from within your source files, make sure the encoding of all files involved matches the output format, unless you will be handling your conversions manually using mb_convert_encoding.

Project Identification


PROJECT INFO
What does this OWASP project offer you?
what is this project?
OWASP PHP AntiXSS Library Project

Purpose: N/A

License: N/A

who is working on this project?
Project Leader: N/A

Project Maintainer:

Project Contributor(s): N/A

how can you learn more?
Project Pamphlet: N/A

3x slide Project Presentation: N/A

Mailing list: N/A

Project Roadmap: N/A

Main links: N/A

Project Health: Yellow button.JPG Not Reviewed (Provisional)
To be reviewed under Assessment Criteria v2.0

Key Contacts
  • Contact the GPC to contribute, review or sponsor this project
  • Contact the GPC to report a problem or concern about this project or to update information.

This category currently contains no pages or media.

Retrieved from "https://wiki.owasp.org/index.php?title=Category:OWASP_PHP_AntiXSS_Library_Project&oldid=67970"