<p>When dealing with XSS concerns, it's important to stay focused on the fact that this is a client-side issue... So in regards to Craft, <strong>Twig</strong> is the star of the show.</p>

<p>Fortunately, Twig takes measures by default to ensure that your output is safe. For example, any time you're outputting some HTML code via a Twig variable, you're required to add a <code>raw</code> filter to get the HTML to render properly. Otherwise, those special characters get encoded and simply rendered "as is" on the front-end. When you apply the <code>raw</code> filter to a Twig variable, you're essentially telling Twig that you trust whatever data may be coming out of that variable.</p>

<p>Here are a few other Twig filters which may help you out:</p>

<ul>
<li><a href="http://twig.sensiolabs.org/doc/filters/escape.html">escape</a></li>
<li><a href="http://twig.sensiolabs.org/doc/filters/striptags.html">striptags</a></li>
</ul>

<hr>

<p>Your question puts an emphasis on data <strong>input</strong>, which isn't typically where XSS issues are addressed. However, there are some things (as you noted) which can help you sort out incoming data.</p>

<p>Validating your data using Yii validation rules is a good start. And I believe the <code>CHtmlPurifier</code> can be useful to you as well. Skimming through the Yii documentation, I believe this helper method can be applied to input data:</p>

<pre><code>$purifier = new \CHtmlPurifier();
$purifier-&gt;purify($html)
</code></pre>

<blockquote>
  <p><a href="http://www.yiiframework.com/doc/api/1.1/CHtmlPurifier">http://www.yiiframework.com/doc/api/1.1/CHtmlPurifier</a></p>
</blockquote>

<p>Simply apply that helper method to data as it's being stored in your Record, and that should make your data safe for future output.</p>

CC BY-SA 3.0
2015-06-05T15:45:27.320Z
[This page](http://www.yiiframework.com/wiki/275/how-to-write-secure-yii-applications/) on Yii security is also worth a look. If anyone else is wondering how to fully escape input outside of Twig, rather than purifying it, you can use `\CHtml::encode($value)`.
Dom Stubbs
CC BY-SA 3.0
2015-10-14T13:33:20.620Z
Can you expand on the process to apply it to data being stored please
PanPipes
CC BY-SA 3.0
2015-10-14T19:25:01.450Z
Hi @PanPipes, I'd recommend [starting a new question](http://craftcms.stackexchange.com/questions/ask). That will allow us to dive deeper into the specific issues you're trying to address.
Lindsey D
CC BY-SA 3.0
2015-10-20T07:04:14.767Z
I think I was more curious about this rather than having a use case. Is there any material online that you could point me at please?
PanPipes
CC BY-SA 3.0
2014-07-07T04:10:07.470Z
Thanks for the updated example Brad! Are you guys using `CHtmlPurifier` anywhere in the Craft core?
Lindsey D
CC BY-SA 3.0
2014-07-08T06:47:29.367Z
Rock solid answer! Cheers mates :)
naboovalley
CC BY-SA 3.0
2014-07-06T22:02:14.417Z
2014-07-07T00:13:28.407Z
2014-07-07T00:13:28.407Z
Lindsey D
<p>I've been playing with Craft for days now and love it. I'm new to Yii but I think I got the hang of everything and how you develop a Craft Plugin. My question is regarding security on input post/get vars.</p>

<p>Reading Yii's documentation is seems the "HtmlPurifier" filter is suggested to protect against XSS - but everything seems to be applied on output?</p>

<p>My question is: Does Craft do anything to "clean" input data OR how do you protect your data against malicious input?</p>

<p>I want to clarify that the data submitted by the user has gone through the validation rules in the Record/Model. Is there anything else you need to keep in mind?</p>

<security>
How do _you_ protect input against XSS? ("HtmlPurifier"?)
# How do _you_ protect input against XSS? ("HtmlPurifier"?)

(Asked by: username_0 on 2014-07-02)

I've been playing with Craft for days now and love it. I'm new to Yii but I think I got the hang of everything and how you develop a Craft Plugin. My question is regarding security on input post/get vars.

Reading Yii's documentation is seems the "HtmlPurifier" filter is suggested to protect against XSS - but everything seems to be applied on output?

My question is: Does Craft do anything to "clean" input data OR how do you protect your data against malicious input?

I want to clarify that the data submitted by the user has gone through the validation rules in the Record/Model. Is there anything else you need to keep in mind?

**Tags:** security

---

## 1 answers

### Answer by username_1 on 2014-07-06. Score: 7 | Accepted answer

When dealing with XSS concerns, it's important to stay focused on the fact that this is a client-side issue... So in regards to Craft, Twig is the star of the show.
Fortunately, Twig takes measures by default to ensure that your output is safe. For example, any time you're outputting some HTML code via a Twig variable, you're required to add a raw filter to get the HTML to render properly. Otherwise, those special characters get encoded and simply rendered "as is" on the front-end. When you apply the raw filter to a Twig variable, you're essentially telling Twig that you trust whatever data may be coming out of that variable.
Here are a few other Twig filters which may help you out:

escape
striptags


Your question puts an emphasis on data input, which isn't typically where XSS issues are addressed. However, there are some things (as you noted) which can help you sort out incoming data.
Validating your data using Yii validation rules is a good start. And I believe the CHtmlPurifier can be useful to you as well. Skimming through the Yii documentation, I believe this helper method can be applied to input data:
$purifier = new \CHtmlPurifier();
$purifier->purify($html)


http://www.yiiframework.com/doc/api/1.1/CHtmlPurifier

Simply apply that helper method to data as it's being stored in your Record, and that should make your data safe for future output.

> **Comments:**
> **username_1**: Thanks for the updated example Brad! Are you guys using `CHtmlPurifier` anywhere in the Craft core?  
> **username_0**: Rock solid answer! Cheers mates :)  
> **username_2**: [This page](http://www.yiiframework.com/wiki/275/how-to-write-secure-yii-applications/) on Yii security is also worth a look. If anyone else is wondering how to fully escape input outside of Twig, rather than purifying it, you can use `\CHtml::encode($value)`.  
> **username_3**: Can you expand on the process to apply it to data being stored please  
> **username_1**: Hi @PanPipes, I'd recommend [starting a new question](http://craftcms.stackexchange.com/questions/ask). That will allow us to dive deeper into the specific issues you're trying to address.  
> **username_3**: I think I was more curious about this rather than having a use case. Is there any material online that you could point me at please?  

---

