title: cakephp3- how to do xss filtering?
body: <p>Cakephp version I'm using is <strong>3.4.x</strong></p>
  
  <p>I have more than a dozen forms in my cakephp 3 application. I wanna implement xss filtering for all forms. What's the easiest way to do this without making changes to all form functions.</p>
  
  <p>I read in one answer that, to sanitize in a view, we should use the CakePHP convenience function h($string) which will render all attempts at XSS completely harmless.</p>
  
  <p>I tried this but id did not work out.</p>
  
  <p><a href="https://i.stack.imgur.com/xIx50.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/xIx50.png" alt="enter image description here"></a></p>
  
  <p><strong>\src\Template\Users\view.ctp</strong></p>
  
  <pre><code>&lt;p&gt;&lt;span&gt;Address&lt;/span&gt;: &lt;?= h($user-&gt;address) ?&gt;&lt;/p&gt;
  </code></pre>
  
  <p><strong>Is there a way to implement xss filtering before saving data to database?</strong></p>
  
  <p>My Controller function (which cakephp baked for me) for adding a new user and his info</p>
  
  <p><strong>\src\Controller\UsersController.php</strong></p>
  
  <pre><code>public function add(){
      $this-&gt;viewBuilder()-&gt;setLayout('admin')  ;
      $user = $this-&gt;Users-&gt;newEntity();
      if ($this-&gt;request-&gt;is('post')) {
          $user = $this-&gt;Users-&gt;patchEntity($user, $this-&gt;request-&gt;getData());
          if ($this-&gt;Users-&gt;save($user)) {
              $this-&gt;Flash-&gt;success(__('The user has been saved.'));
  
              return $this-&gt;redirect(['action' =&gt; 'index']);
          }
          $this-&gt;Flash-&gt;error(__('The user could not be saved. Please, try again.'));
      }
      $groups = $this-&gt;Users-&gt;Groups-&gt;find('list', ['limit' =&gt; 200]);
      $this-&gt;set(compact('user', 'groups'));
      $this-&gt;set('_serialize', ['user']);
  }
  </code></pre>
  
  <p><strong>\src\Model\Table\UsersTable.php</strong></p>
  
  <pre><code>public function beforeSave(Event $event)
  {
      $entity = $event-&gt;getData('entity');
  
      if ($entity-&gt;isNew()) {
          $hasher = new DefaultPasswordHasher();
  
          // Generate an API 'token'
          $entity-&gt;api_key_plain = sha1(Text::uuid());
  
          // Bcrypt the token so BasicAuthenticate can check
          // it during login.
          $entity-&gt;api_key = $hasher-&gt;hash($entity-&gt;api_key_plain);
      }
      return true;
  }
  </code></pre>
  
  <p>Thanks!</p>