Input validation and output escaping
This page is for application creators who handle data from requests, imports or APIs. Two rules prevent most security bugs: validate input where it enters, escape output where it leaves, in the format of the place it goes.
Contents
Validating input
| Input | Validate |
|---|---|
| IDs and numbers | (int), then a range check (max( 1, min( 100, (int)$limit ) )) |
| Choices | an allow list: in_array( $sort, array( 'name', 'published' ), true ) |
| Text | length limits, trim, the characters allowed for the field |
| E-mail, URL | the datatype or filter_var() validation; for URLs also the scheme (https only) |
| Files | type by content and size, stored through the kernel |
| Redirect targets | only addresses of the site (Safe redirects) |
View parameters ($Params) and unordered parameters are strings from the address, as untrusted as POST data.
Escaping output
In templates, every value from users or the database goes through |wash:
<h1>{$item.title|wash}</h1>
<a href={$item.url|ezurl} title="{$item.title|wash}">...</a>
<div data-conf="{json_encode( hash( 'id', $item.id ) )|wash}"></div>Exceptions are values that are already safe HTML by design: $module_result.content, the output of
attribute_view_gui and of rich text rendering.
Contexts and their escaping
| Output goes into | Escape with |
|---|---|
| HTML text and attributes | |wash (templates), htmlspecialchars( $v, ENT_QUOTES, 'UTF-8' ) (PHP) |
| URLs in templates | |ezurl for site paths; rawurlencode() for parts of a URL (Templates and design, part 10) |
| JSON | json_encode(); inside a <script type="application/json"> also replace < and > |
| SQL | casts and $db->escapeString(), or eZPersistentObject conditions |
| Shell commands | avoid; otherwise escapeshellarg() |
| CSV for spreadsheets | prefix values starting with =, +, -, @ (the kernel's CSV export does) |
| Log lines | strip line breaks; never log secrets |
Common mistakes
{$value}without|washbecause "it is only a number": a later change makes it text.- Trusting a hidden form field.
- Building a redirect from
$_SERVER['HTTP_REFERER']. - Escaping on input instead of on output (double escaping, or none in a new output).
- A JSON value printed into an inline script: use a data block or attribute instead.
Related pages
- Forms, CSRF protection and HTTP input
- Security for applications
- Security standard
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.