PHPackages initphp/escaper - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. initphp/escaper ActiveLibrary[Security](/categories/security) initphp/escaper =============== Context-aware output escaper (HTML, attribute, JavaScript, CSS, URL) for safely rendering untrusted user input. 2.0.0(2mo ago)1381MITPHPPHP >=7.4CI passing Since Mar 16Pushed 1mo ago1 watchersCompare [ Source](https://github.com/InitPHP/Escaper)[ Packagist](https://packagist.org/packages/initphp/escaper)[ RSS](/packages/initphp-escaper/feed)WikiDiscussions main Synced 1w ago READMEChangelog (2)Dependencies (3)Versions (5)Used By (0) initphp/escaper =============== [](#initphpescaper) Context-aware output escaper for PHP. Safely render untrusted user input inside HTML, HTML attributes, JavaScript, CSS and URLs. [![Latest Stable Version](https://camo.githubusercontent.com/3afdf47d0651847b854a2022a47a2c28c233b0323d56c7c4a22f54571795577e/68747470733a2f2f706f7365722e707567782e6f72672f696e69747068702f657363617065722f76)](https://packagist.org/packages/initphp/escaper)[![PHP Version Require](https://camo.githubusercontent.com/3e1e4b214a02ae1dcadc8564d9f86806c9c1854e847aea96200e9ef262fde3a5/68747470733a2f2f706f7365722e707567782e6f72672f696e69747068702f657363617065722f726571756972652f706870)](https://packagist.org/packages/initphp/escaper)[![CI](https://github.com/InitPHP/Escaper/actions/workflows/ci.yml/badge.svg)](https://github.com/InitPHP/Escaper/actions/workflows/ci.yml)[![codecov](https://camo.githubusercontent.com/aa0aa018b20194344c3e4ee2f8e8bf60faa9fce9a2a26c85a47381883a5d6286/68747470733a2f2f636f6465636f762e696f2f67682f496e69745048502f457363617065722f6272616e63682f6d61696e2f67726170682f62616467652e737667)](https://codecov.io/gh/InitPHP/Escaper)[![License](https://camo.githubusercontent.com/2a8f3b5752e83edebc079cf21cad40fae7386f2e149c218549e4d166ab61828a/68747470733a2f2f706f7365722e707567782e6f72672f696e69747068702f657363617065722f6c6963656e7365)](https://packagist.org/packages/initphp/escaper)[![Total Downloads](https://camo.githubusercontent.com/09626d806e879b1e0b4d15a31e474a5360a735b32416978c63e4294e10d9a319/68747470733a2f2f706f7365722e707567782e6f72672f696e69747068702f657363617065722f646f776e6c6f616473)](https://packagist.org/packages/initphp/escaper) `htmlspecialchars()` is not enough on its own. Each output context — an HTML body, an attribute, a JavaScript string literal, a CSS value, a URL parameter — needs its own escaping rules, and using the wrong one can leave you exposed to XSS even when you *think* you have escaped your data. `initphp/escaper` implements the rules from the [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)for the five most common contexts, behind a small, dependency-free API. Installation ------------ [](#installation) ``` composer require initphp/escaper ``` ### Requirements [](#requirements) - PHP 7.4 or newer - `ext-ctype` - `ext-mbstring` (required); `ext-iconv` is used when present and preferred over mbstring Quick start ----------- [](#quick-start) ``` use InitPHP\Escaper\Esc; echo Esc::esc('alert(1)'); // <script>alert(1)</script> echo Esc::esc('faketitle onmouseover=alert(1);', 'attr'); // faketitle onmouseover=alert(1); echo Esc::esc('"; alert(1); var x="', 'js'); // \x22\x3B\x20alert\x281\x29\x3B\x20var\x20x\x3D\x22 echo Esc::esc('alert(1)', 'css'); // \3C \2F style\3E \3C script\3E alert\28 1\29 \3C \2F script\3E echo Esc::esc('" onmouseover="alert(1)', 'url'); // %22%20onmouseover%3D%22alert%281%29 ``` `Esc::esc()` also accepts arrays and recurses into them, so escaping a whole request payload at the view boundary is a one-liner: ``` $safe = Esc::esc($_GET, 'html'); ``` API --- [](#api) ### `Esc::esc()` [](#escesc) ``` public static function esc( array|string $data, string $context = 'html', ?string $encoding = null ): array|string; ``` ArgumentDescription`$data`A string, or an array (which is escaped recursively).`$context``html`, `attr`, `js`, `css`, `url`, or `raw` (returns input unchanged).`$encoding`Output encoding. `null` resolves to UTF-8. See [Encodings](docs/encodings.md).Throws `InitPHP\Escaper\Exception\InvalidContextException` for unknown contexts. ### `Escaper` [](#escaper) For lower-level use, instantiate `Escaper` directly. Each instance is bound to one encoding and exposes one method per context: ``` use InitPHP\Escaper\Escaper; $escaper = new Escaper(); // utf-8 $escaper = new Escaper('windows-1252'); $escaper->escHtml($string); $escaper->escHtmlAttr($string); $escaper->escJs($string); $escaper->escCss($string); $escaper->escUrl($string); ``` Documentation ------------- [](#documentation) The [`docs/`](docs/) directory contains a per-context walkthrough with examples, do-and-don't guidance and security notes: - [Getting started](docs/getting-started.md) - [HTML body context](docs/context-html.md) - [HTML attribute context](docs/context-html-attribute.md) - [JavaScript context](docs/context-javascript.md) - [CSS context](docs/context-css.md) - [URL context](docs/context-url.md) - [Encodings](docs/encodings.md) - [Exceptions](docs/exceptions.md) - [Security notes](docs/security-notes.md) A word of warning ----------------- [](#a-word-of-warning) > Output escaping prevents XSS but it is not a substitute for input validation, authentication, or authorisation. It is also context-sensitive: the JavaScript escaper assumes the caller wraps the result in quotes, the HTML attribute escaper assumes the value is used as a single attribute value, and so on. Read the per-context docs before mixing contexts. Contributing ------------ [](#contributing) Contributions are welcome. Please read the [org-wide CONTRIBUTING guide](https://github.com/InitPHP/.github/blob/main/CONTRIBUTING.md)for the workflow, coding standards and test expectations. A typical loop is: ``` git clone https://github.com/InitPHP/Escaper.git cd Escaper composer install composer ci # cs-check + phpstan + phpunit ``` Individual steps are also available: CommandWhat it does`composer test`Run PHPUnit`composer stan`Run PHPStan (max level)`composer cs-check`Report PHP-CS-Fixer violations, no changes`composer cs-fix`Apply PHP-CS-Fixer changesSecurity -------- [](#security) If you discover a security issue, please follow the disclosure process documented in [SECURITY.md](https://github.com/InitPHP/.github/blob/main/SECURITY.md)rather than opening a public issue. License ------- [](#license) Released under the [MIT License](./LICENSE). © InitPHP. ### Health Score 42 — FairBetter than 88% of packages Maintenance87 Actively maintained with recent releases Popularity10 Limited adoption so far Community8 Small or concentrated contributor base Maturity53 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~516 days Total 4 Last Release 56d ago Major Versions 1.x-dev → 2.0.02026-05-25 ### Community Maintainers ![](https://www.gravatar.com/avatar/4b6b34f3ac8938d8ee52ba3bd260680855dc5715c7b2929d9380de30d15a67dd?d=identicon)[muhammetsafak](/maintainers/muhammetsafak) --- Top Contributors [![muhammetsafak](https://avatars.githubusercontent.com/u/104234499?v=4)](https://github.com/muhammetsafak "muhammetsafak (5 commits)") --- Tags escaperhtml-escapinginitphpjavascript-escaperoutput-encodingowaspphpphp-librarypsr-12securityxssxss-preventionurljavascriptcsssecurityhtmlescaperxssEscapeowaspoutput-encoding ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StylePHP CS Fixer Type Coverage Yes ### Embed Badge ![Health badge](/badges/initphp-escaper/health.svg) ``` [![Health](https://phpackages.com/badges/initphp-escaper/health.svg)](https://phpackages.com/packages/initphp-escaper) ``` ### Alternatives [mews/purifier Laravel 5/6/7/8/9/10 HtmlPurifier Package 2.0k19.5M148](/packages/mews-purifier)[owasp/csrf-protector-php CSRF protector php, a standalone php library for csrf mitigation in web applications. Easy to integrate in any php web app. 215377.3k6](/packages/owasp-csrf-protector-php)[nzo/url-encryptor-bundle The NzoUrlEncryptorBundle is a Symfony Bundle used to Encrypt and Decrypt data and variables in the Web application or passed through URL 951.1M2](/packages/nzo-url-encryptor-bundle)[tilleuls/url-signer-bundle Create and validate signed URLs with a limited lifetime in Symfony 80380.3k](/packages/tilleuls-url-signer-bundle) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)