Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
abacaphiliac committed Aug 11, 2016
1 parent 01828b8 commit 8f43a69
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions README.md
Expand Up @@ -9,6 +9,7 @@ Safely encode content for rendering in an HTML document.

## Brief XSS Mitigation Guide
A quote from (Paragon Initiative's blog)[https://paragonie.com/blog/2015/06/preventing-xss-vulnerabilities-in-php-everything-you-need-know]:

1. If your framework has a templating engine that offers automatic contextual filtering, use that.
1. `echo htmlentities($string, ENT_QUOTES | ENT_HTML5, 'UTF-8');` is a safe and effective way to stop all XSS attacks on a UTF-8 encoded web page, but doesn't allow any HTML.
1. If your requirements allow you to use Markdown instead of HTML, don't use HTML.
Expand Down

0 comments on commit 8f43a69

Please sign in to comment.