Security - malicious file within root and assets found

[ezraverheijen]

@carstengrimm

form is processed with esc(get(‘value’)) - validated via contact form sample from bastian on github.

is there any other requirement, other then esc()

The esc() helper is not intended for input sanitizing, but for escaping HTML, XML, CSS and JavaScript output.
There are other ways to check user input, like filter_var() etc.

You don’t want to escape and store something like <script>deleteContent()</script>. It makes no sense.
You want to block that entirely from getting through, right?

And if something does get through somehow, we can prevent it from doing harm on the frontend with esc().

To escape or not to escape

I see it too often in the forum and the docs: people using the esc() helper in a wrong way, or not using it when they actually should. For example, with input sanitization: <?php $var = esc(get('var')) ?> or using the ‘legacy’ html() version: <h1><?php echo $page->title()->html() ?></h1> Please use the toolkit Escape class and the corresponding esc() helper for what they are intended for: XSS (Cross Site Scripting) prevention. <h1><?php echo $page->title()->esc() ?></h1> or the …