#xss

PHP strings that HTML-encode themselves on echo, interpolation, and concatenation. XSS-safe by default and at least 3x faster than calling htmlspecialchars() yourself.

PHP/MySQL database layer where values only enter SQL through placeholders and every result HTML-encodes itself on output. Faster than prepared statements plus htmlspecialchars() on every measured page, within microseconds of raw SQL.

HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values.

Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist

micromark extension to support GFM tagfilter

渗透测试Payload速查平台 | Pentest Payload Quick Reference | XSS/SQLi/SSRF/RCE | React+TypeScript

Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across HTML, XML, SVG, SQL, SHELL, NOSQL, and REGEX contexts

A support package for web developer.