You are using the documentation for version 2.11.9. Go here for the latest version or check here for your available upgrades to the latest version.
Calling the Security Class¶
This class is initialized automatically.
Cross Site Scripting Protection¶
For general XSS protection handling, please refer to the Cross Site Scripting section of the security guidelines.
xss_clean($str[, $is_image = FALSE])¶
xss_clean()is the built in ExpressionEngine XSS sanitization method, which is constantly tweaked for improved security and performance:
$str = ee()->security->xss_clean($str);
- $str (mixed) – Either a string or an array to sanitize
- $is_image (boolean) – Set to
TRUEif you want to test images for XSS attacks.
Either a string or an array of sanitized strings. If
$is_imageis set to
TRUE, will return
FALSEif the image fails the check.
Cross Site Request Forgery Protection¶
For general CSRF protection handling, please refer to the Cross Site Request Forgery section of the security guidelines.
restore_xid([$xid = REQUEST_XID])¶
Deprecated since version 2.8: CSRF Tokens are now multi-use.
By default all XIDs are single use tokens. In some cases you may want to allow reuse of the token. To do this you can call
restore_xid()at any point during the request that consumed the token.
Other Class Methods¶
sanitize_filename($str[, $relative_path = FALSE])¶
Removes naughty characters from filenames. Returns a sanitized string:
$filename = ee()->security->sanitize_filename($name);
- $str (string) – Filename to sanitize
- $relative_path (boolean) – Set to
TRUEif you want to validate a filename with a relative path
Returns a random hash:
Returns: Random hash Return type: String