Skip to content

Ability to detect xss, hasSpecialChars function #18946

Closed
@mikeldoka1

Description

@mikeldoka1

Description

Hi, i want to propose adding a new function to php which will detect if a string has special characters or not in order to deny requests that may have xss payloads.

Use case:
Consider platforms that heavily rely on input data that do not require special characters, eg most of the input data are numbers etc. While the only cases where strings are needed are for user profile data and alike.

The main reason for proposing this is for example, if we use laravel filament, it does not have the ability to set CSP headers for security, i bet there are many cases like that.
Why store such data when this data is not supposed to be allowed at all and have a security risk where the end part that will show the data may not be properly secure.

So i propose a function called hasSpecialChars: bool. Same as htmlspecialchars function but in our case just return true or false.

If you worked on different projects, especially older ones, you will see hacky ways devs have tried to implement this. While the flow of sanitize input, validate output works fine, this feature wont harm no one.

What to consider:
Ensuring configurability so that it works with different characters like names for unique countries, also some names that have a valid single quote as name

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions