---
title: "Contextual Escaping"
version: "3.4"
---
> Documentation Index
> Fetch the complete documentation index at: https://docs.phalcon.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Contextual Escaping
Websites and web applications are vulnerable to [XSS](https://www.owasp.org/index.php/XSS) attacks and although PHP provides escaping functionality, in some contexts it is not sufficient/appropriate. [Phalcon\Escaper](/3.4/api/phalcon_escaper/) provides contextual escaping and is written in Zephir, providing the minimal overhead when escaping different kinds of texts.
We designed this component based on the [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet) created by the [OWASP](https://www.owasp.org).
Additionally, this component relies on [mbstring](https://php.net/manual/en/book.mbstring.php) to support almost any charset.
To illustrate how this component works and why it is important, consider the following example:
```php
";
// Malicious CSS class name
$className = ";`(";
// Malicious CSS font name
$fontName = "Verdana\"";
// Malicious Javascript text
$javascriptText = "';Hello";
// Create an escaper
$e = new Escaper();
?>
<?php echo $e->escapeHtml($maliciousTitle); ?>
hello
```
Which produces the following:
```html
</title><script>alert(1)</script>
hello
```
Every text was escaped according to its context. Use the appropriate context is important to avoid XSS attacks.
## Escaping HTML
The most common situation when inserting unsafe data is between HTML tags:
```html
```
You can escape those data using the `escapeHtml` method:
```php
myattack
'); ?>
```
Which produces:
```html
```
## Escaping HTML Attributes
Escaping HTML attributes is different from escaping HTML content. The escaper works by changing every non-alphanumeric
character to the form. This kind of escaping is intended to most simpler attributes excluding complex ones like `href` or `url`:
```html
```
You can escape a HTML attribute by using the `escapeHtmlAttr` method:
```php
```
Which produces:
```html
```
## Escaping URLs
Some HTML attributes like `href` or `url` need to be escaped differently:
```html
Some link
```
You can escape a HTML attribute by using the :code:`escapeUrl` method:
```php
Some link
```
Which produces:
```html
Some link
```
## Escaping CSS
CSS identifiers/values can be escaped too:
```html
Some link
```
You can escape a CSS identifiers/value by using the :code:`escapeCss` method:
```php
Some link
```
Which produces:
```html
Some link
```
## Escaping JavaScript
Strings to be inserted into JavaScript code also must be properly escaped:
```html
```
You can escape JavaScript code by using the `escapeJs` method:
```php
```
```html
```
Source: https://docs.phalcon.io/3.4/escaper/index.mdx