Getting Started

Install via Composer: composer require zendframework/zend-escaper
The component provides security-focused escaping for output contexts (HTML, JS, CSS, URL, and raw data)
Start by instantiating \Zend\Escaper\Escaper — it's stateless and thread-safe, so one instance can be reused (e.g., via dependency injection or a singleton)

First use case: escaping user-provided data before embedding in HTML:

$escaper = new \Zend\Escaper\Escaper('utf-8');
echo $escaper->escapeHtml($userInput); // Safely outputs as HTML text content

Implementation Patterns

Context-Aware Escaping: Use the appropriate method for the output context:
- escapeHtml() for HTML element content (not attributes)
- escapeHtmlAttr() for HTML attributes
- escapeJs() for JavaScript string literals
- escapeCss() for CSS property values
- escapeUrl() for URL query parameters or full URLs (with validation)
- escapeHtmlLower() / escapeHtmlUpper() for less common cases (rarely needed)
Integration with Frameworks:
- In Laravel: Bind Escaper as a singleton in a service provider; create a e() helper wrapping $escaper->escapeHtml() if replacing Blade’s default {{ }}
- In Symfony: Register as a service; use in templates via escapeHtml() in custom Twig filters
Consistency: Wrap all untrusted output — never assume $变量, $request->input(), or DB results are safe
Batch Escaping: When rendering multiple values, inject a shared Escaper instance rather than creating many — performance is negligible, but reuse avoids duplication

Do NOT use escapeHtml() for attributes — use escapeHtmlAttr() or htmlspecialchars() with ENT_QUOTES manually. escapeHtml() intentionally does not escape quotes, assuming HTML content context
No auto-escaping in templates — this is a manual escaping library; unlike modern frameworks (e.g., Blade, Twig), it doesn’t hook into view rendering automatically — disciplined adherence required
Encoding matters: Always specify 'utf-8' (or your app’s encoding) in the constructor — default may break non-ASCII content
Deprecated but stable: Since Zend Framework is archived, prefer laminas/laminas-escaper instead (same API, maintained by Laminas Project); zendframework/zend-escaper will continue to work but won’t receive updates
Debugging: Escaped output that looks “broken” (e.g., & instead of &) usually means double-escaping — trace whether data was already escaped before reaching the escaper
Extension point: Subclass Escaper to add domain-specific escaping (e.g., escapeMarkdown()), but avoid overriding core methods — extend only with new methods