474. Class

474.1. Zend\Escaper\Escaper

Context specific methods for use in secure output escaping

474.1.1. Methods

474.1.1.1. __construct

__construct()

Constructor: Single parameter allows setting of global encoding for use by the current object. If PHP 5.4 is detected, additional ENT_SUBSTITUTE flag is set for htmlspecialchars() calls.

Parameters:string – Throws ExceptionInvalidArgumentException:  

474.1.1.2. getEncoding

getEncoding()

Return the encoding that all output/input is expected to be encoded in.

Return type:string

474.1.1.3. escapeHtml

escapeHtml()

Escape a string for the HTML Body context where there are very few characters of special meaning. Internally this will use htmlspecialchars().

Parameters:string – Return type:string

474.1.1.4. escapeHtmlAttr

escapeHtmlAttr()

Escape a string for the HTML Attribute context. We use an extended set of characters to escape that are not covered by htmlspecialchars() to cover cases where an attribute might be unquoted or quoted illegally (e.g. backticks are valid quotes for IE).

Parameters:string – Return type:string

474.1.1.5. escapeJs

escapeJs()

Escape a string for the Javascript context. This does not use json_encode(). An extended set of characters are escaped beyond ECMAScript’s rules for Javascript literal string escaping in order to prevent misinterpretation of Javascript as HTML leading to the injection of special characters and entities. The escaping used should be tolerant of cases where HTML escaping was not applied on top of Javascript escaping correctly. Backslash escaping is not used as it still leaves the escaped character as-is and so is not useful in a HTML context.

Parameters:string – Return type:string

474.1.1.6. escapeUrl

escapeUrl()

Escape a string for the URI or Parameter contexts. This should not be used to escape an entire URI - only a subcomponent being inserted. The function is a simple proxy to rawurlencode() which now implements RFC 3986 since PHP 5.3 completely.

Parameters:string – Return type:string

474.1.1.7. escapeCss

escapeCss()

Escape a string for the CSS context. CSS escaping can be applied to any string being inserted into CSS and escapes everything except alphanumerics.

Parameters:string – Return type:string

474.1.1.8. htmlAttrMatcher

htmlAttrMatcher()

Callback function for preg_replace_callback that applies HTML Attribute escaping to all matches.

Parameters:array – Return type:string

474.1.1.9. jsMatcher

jsMatcher()

Callback function for preg_replace_callback that applies Javascript escaping to all matches.

Parameters:array – Return type:string

474.1.1.10. cssMatcher

cssMatcher()

Callback function for preg_replace_callback that applies CSS escaping to all matches.

Parameters:array – Return type:string

474.1.1.11. toUtf8

toUtf8()

Converts a string to UTF-8 from the base encoding. The base encoding is set via this class’ constructor.

Parameters:string – Throws ExceptionRuntimeException:   Return type:string

474.1.1.12. fromUtf8

fromUtf8()

Converts a string from UTF-8 to the base encoding. The base encoding is set via this class’ constructor.

Parameters:string – Return type:string

474.1.1.13. isUtf8

isUtf8()

Checks if a given string appears to be valid UTF-8 or not.

Parameters:string – Return type:bool

474.1.1.14. convertEncoding

convertEncoding()

Encoding conversion helper which wraps iconv and mbstring where they exist or throws and exception where neither is available.

Parameters:

• string –
• string –
• array|string –

Throws ExceptionRuntimeException:   Return type:

string