This $ this-> escape () in the Zend view is enough for xss

Question

I do a lot $this->escape()in zend view. Is this enough to prevent XSS?

There HTMLPurifier outside of the Zend Framework. I wonder how zend $this->escape()compares with HTMLPurifier.

Answer 1

escape is an alias of htmlspecialchars. It allows you to display plain text, while HTMLPurifier allows you to display safe HTML.

You cannot have plaintext XSS.

HTMLPurifier strip_tags, HTML, (, ).

Answer 2

HTMLPurifier . HTMLPurifier HTML... , . , , , HTML, , . HTML, , /.

escape() HTML- HTML, , HTML (, & → &, < → <, > → > ..).

.

XSS? , , .