laminas/laminas-escaper
Securely escape untrusted data for HTML, HTML attributes, JavaScript, CSS, and URLs to prevent XSS. Laminas Escaper provides robust, context-aware escaping utilities for PHP apps and templates.
Feature release (minor)
Feature release (minor)
EscaperInterface thanks to @demiankatzFeature release (minor)
Feature release (minor)
Feature release (minor)
Feature release (minor)
Feature release (minor)
Feature release (minor)
ExceptionInterface should extend from Throwable thanks to @gsteelFeature release (minor)
Feature release (minor)
Feature release (minor)
In release 2.7.1, multiple users reported crashes due to the introduction of declare(strict_types=1); in our codebase:
These crashes were related to misuse of the library on the caller side, since this library always expected string values as inputs for most its methods.
This release replaces declared input type declarations with native type declarations provided by PHP.
The reason why this was done, is that:
Escaper that do not declare string parameters in their methods will continue to work as expectedstring type declaration will lead to more shallow stack traces in the case of invalid input, which will further help avoiding misunderstanding of the issue, like what happened in https://github.com/laminas/laminas-escaper/issues/20. Developers should be able to determine more clearly that a non-string was given as inputlaminas/laminas-escaper, should they not use declare(strict_types=1) in their code, then there will be an implicit conversion performed by the engine, as specified by PHP 7.0 in the Scalar Type Hints v5 by @ircmaxellThis release therefore:
2.7.x bugfix release (patch)
next feature release (minor)
How can I help you explore Laravel packages today?