[php-src] Issue #18946: Ability to detect xss, hasSpecialChars function
| From: | mikeldoka1 | Date: | Thu, 26 Jun 2025 08:39:21 +0000 |
| Subject: | [php-src] Issue #18946: Ability to detect xss, hasSpecialChars function | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-250326@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/18946
Author: mikeldoka1
### Description
Hi, i want to propose adding a new function to php which will detect if a string has special
characters or not in order to deny requests that may have xss payloads.
Use case:
Consider platforms that heavily rely on input data that do not require special characters, eg most
of the input data are numbers etc. While the only cases where strings are needed are for user
profile data and alike.
The main reason for proposing this is for example, if we use laravel filament, it does not have the
ability to set CSP headers for security, i bet there are many cases like that.
Why store such data when this data is not supposed to be allowed at all and have a security risk
where the end part that will show the data may not be properly secure.
So i propose a function called hasSpecialChars: bool. Same as htmlspecialchars function but in our
case just return true or false.
If you worked on different projects, especially older ones, you will see hacky ways devs have tried
to implement this. While the flow of sanitize input, validate output works fine, this feature wont
harm no one.
What to consider:
Ensuring configurability so that it works with different characters like names for unique countries,
also some names that have a valid single quote as name