16

Is check_plain() enough for re-displaying the text entered by users in the browser, or should I still filter with filter_xss()?

25

I imagine the question is about using check_plain(filter_xss($string)), or filter_xss(check_plain($string)).

check_plain() and filter_xss() have two different, and in contrast, purposes:

  • check_plain() encodes special characters in a plain-text string that is then displayed as HTML.
  • filter_xss() filters an HTML string to prevent cross-site-scripting (XSS) vulnerabilities. In particular its purpose is:

    • Removing characters and constructs that can trick browsers
    • Making sure all HTML entities are well-formed
    • Making sure all HTML tags and attributes are well-formed
    • Making sure no HTML tags contain URLs with a disallowed protocol (e.g. javascript:)

If you use check_plain(), the string passed to the function is supposed to be used as plain text; in such case, filter_xss() is not necessary. If you use filter_xss(), then the string passed to the function is supposed to be HTML, and check_plain() is not necessary.

If the question is about using check_plain() and filter_xss() on different parts of the same string then, as greggles pointed out in his comment, you can use (for example) check_plain() on the content of tag attributes, and filter_xss() on the entire HTML tag.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.