joseconti/klytos-escape-and-sanitization

Klytos Escape & Sanitization Reference

When to Use This Skill

The golden rules:

• ALWAYS escape output before rendering in HTML, attributes, URLs, or JavaScript.
• ALWAYS sanitize input before storing or processing user-provided data.
• NEVER trust external data — treat everything from $_POST, $_GET, MCP params, and API inputs as untrusted.

---

Output Escaping Functions

klytos_esc_html — For HTML Body Content

klytos_esc_html(string $text): string

Converts &, <, >, ", ' to HTML entities. Safe against double-encoding.

<p><?php echo klytos_esc_html($userInput); ?></p>

klytos_esc_attr — For HTML Attributes

klytos_esc_attr(string $text): string

Same as esc_html but also strips tabs, newlines, carriage returns to prevent attribute-injection.

<input type="text" value="<?php echo klytos_esc_attr($value); ?>">

klytos_esc_url — For URLs (href, src)

klytos_esc_url(string $url, array $protocols = ['http', 'https', 'mailto', 'tel']): string

Validates protocol allowlist. Rejects javascript:, data:, vbscript:. Returns empty string if invalid.

<a href="<?php echo klytos_esc_url($link); ?>">

klytos_esc_js — For JavaScript String Literals

klytos_esc_js(string $string): string

Escapes ', ", \, newlines, and </script>.

<script>var name = '<?php echo klytos_esc_js($name); ?>';</script>

klytos_esc_textarea — For Textarea Content

klytos_esc_textarea(string $text): string

Quick Reference

| Context | Function | |---|---| | Inside <p>, <h1>, <span> | klytos_esc_html() | | Inside value="", data-*="" | klytos_esc_attr() | | Inside href="", src="" | klytos_esc_url() | | Inside <script> string | klytos_esc_js() | | Inside <textarea> | klytos_esc_textarea() |

---

Input Sanitization Functions

klytos_sanitize_text(string $text): string        // Strip tags, normalize whitespace, trim
klytos_sanitize_email(string $email): string      // Validate + lowercase (empty if invalid)
klytos_sanitize_url(string $url): string          // Strip control chars, reject dangerous protocols
klytos_sanitize_filename(string $name): string    // basename, replace unsafe chars, fallback 'unnamed'
klytos_sanitize_key(string $key): string          // Lowercase a-z0-9_- only
klytos_sanitize_title(string $title): string      // Delegates to sanitizeSlug()
klytos_sanitize_html(string $html): string        // Strip dangerous tags, remove event handlers
klytos_sanitize_int(mixed $value): int            // Cast to safe int
klytos_sanitize_float(mixed $value): float        // Cast to safe float

---

HTML Filtering (KSES)

klytos_kses — Custom Tag Allowlist

klytos_kses(string $html, array $allowedTags): string

$safe = klytos_kses($input, [
    'a'      => ['href' => true, 'title' => true],
    'strong' => [],
    'em'     => [],
    'p'      => ['class' => true],
]);

klytos_kses_post — Page Content Allowlist

klytos_kses_post(string $html): string

Allowed (~40 tags): h1-h6, p, br, hr, a, img, ul, ol, li, table, thead, tbody, tr, th, td, strong, em, b, i, u, s, blockquote, pre, code, span, div, section, article, header, footer, nav, main, aside, figure, figcaption, video, audio, source, details, summary, mark, small, sub, sup, dl, dt, dd.

Excluded: script, style, iframe, form, object, embed, svg.

Extendable via kses_post_allowed_tags filter.

---

CSRF Protection

klytos_csrf_field(): string       // Returns <input type="hidden" name="csrf" value="...">
klytos_verify_csrf(): bool        // Checks POST['csrf'], X-CSRF-Token header, GET['csrf']

<form method="POST">
    <?php echo klytos_csrf_field(); ?>
    <button type="submit">Save</button>
</form>

// Processing:
if ($_SERVER['REQUEST_METHOD'] === 'POST' && klytos_verify_csrf()) {
    // Safe to process
}

IMPORTANT: Every POST form in admin MUST include CSRF protection.

---

Validation Helpers

klytos_is_email(string $email): bool    // filter_var(FILTER_VALIDATE_EMAIL)
klytos_is_url(string $url): bool        // Valid http/https URL

---

Complete Example: Secure Form

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST' && klytos_verify_csrf()) {
    $name  = klytos_sanitize_text($_POST['name'] ?? '');
    $email = klytos_sanitize_email($_POST['email'] ?? '');
    $count = klytos_sanitize_int($_POST['count'] ?? 0);

    if ($name === '') { $error = 'Name required'; }
    elseif (!klytos_is_email($email)) { $error = 'Invalid email'; }
    else {
        klytos_set_option('my-plugin.name', $name);
        klytos_set_option('my-plugin.email', $email);
        $success = 'Saved';
    }
}
$name = klytos_get_option('my-plugin.name', '');
?>

<form method="POST">
    <?php echo klytos_csrf_field(); ?>
    <input name="name" value="<?php echo klytos_esc_attr($name); ?>">
    <button type="submit" class="btn btn-primary">Save</button>
</form>

---

Source Files

• Escape/sanitization: core/helpers.php (lines 423-944)
• Global wrappers: core/helpers-global.php
• KSES tags: core/helpers.php (line 709)
• CSRF: core/helpers.php (lines 913-944)