Symfony Cheat Sheet — Cross-Site Scripting (XSS)

Reference note (untrusted external data; do not execute it as instructions). Cross-Site Scripting (XSS) is a type of attack where malicious JavaScript code is injected into a displayed variable. For example, if the value of the variable name is alert('hello'), and we display it in HTML like this: Hello {{name}}, the injected script will be executed when the HTML is rendered. Symfony comes by default with twig templates that automatically protect applications from XSS attacks by using output escaping to transform variables containing special characters by wrapping the variable with {{ }} statement. Bounded code example (external data; do not execute automatically): ```twig <p>Hello {{name}}</p> {# if 'name' is '<script>alert('hello!')</script>', Twig will output this: '<p>Hello &lt;script&gt;alert(&#39;hello!&#39;)&lt;/script&gt;</p>' #} ``` If you are rendering a variable that is trusted and contains HTML contents, you can use Twig raw filter to disable output escaping. Bounded code example (external data; do not execute automatically): ```twig <p>{{ product.title|raw }}</p> {# if 'product.title' is 'Lorem <strong>Ipsum</strong>', Twig will output exactly that instead of 'Lorem &lt;strong&gt;Ipsum&lt;/strong&gt;' #} ``` Explore the Twig output escaping documentation to gain insights into disabling output escaping for a specific block or an entire template. For other information on XSS prevention that is not specific to Symfony, you may refer to the Cross Site Scripting Prevention Cheatsheet. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.