Is check_plain() enough?

Question

Is check_plain() enough for re-displaying the text entered by users in the browser, or should I still filter with filter_xss()?

Answer 1

I imagine the question is about using check_plain(filter_xss($string)), or filter_xss(check_plain($string)).

check_plain() and filter_xss() have two different, and in contrast, purposes:

• check_plain() encodes special characters in a plain-text string that is then displayed as HTML.

• filter_xss() filters an HTML string to prevent cross-site-scripting (XSS) vulnerabilities. In particular its purpose is:

  • Removing characters and constructs that can trick browsers
  • Making sure all HTML entities are well-formed
  • Making sure all HTML tags and attributes are well-formed
  • Making sure no HTML tags contain URLs with a disallowed protocol (e.g. javascript:)

If you use check_plain(), the string passed to the function is supposed to be used as plain text; in such case, filter_xss() is not necessary. If you use filter_xss(), then the string passed to the function is supposed to be HTML, and check_plain() is not necessary.

If the question is about using check_plain() and filter_xss() on different parts of the same string then, as greggles pointed out in his comment, you can use (for example) check_plain() on the content of tag attributes, and filter_xss() on the entire HTML tag.