<?php 

namespace NinjaForms\Includes\Handlers;

/**
 * Sanitize output for enhanced functionality while maintaining security
 */
class Sanitizer{

    const DISALLOWED_SCRIPT_TRIGGERS=[
        '/<\s*(script)/i', // < script (includes empty spaces after opening tag)
        '/(onload)/i', // word 'onload' 
        '/(onerror)/i', // word 'onerror'
        '/(onfocus)/i', // word 'onfocus'
        '/(javascript)/i' // word 'javascript'
    ];

    /**
     * Block disallowed script triggering text
     *
     * @param string $string
     * @return string
     */
   public static function preventScriptTriggerInHtmlOutput(string $string): string
    {
        $return = $string;

        $fail = false;

        foreach(self::DISALLOWED_SCRIPT_TRIGGERS as $disallowedString){
            $preg_match = preg_match($disallowedString,$string);

            if($preg_match){
                $fail = true;
            }
        }

        if($fail){
            $return = htmlspecialchars($return,\ENT_QUOTES);
        }

        return $return;
    }
}

• [F] DateTimeConverter.php
  Delete
• [F] Field.php
  Delete
• [F] FieldsetRepeater.php
  Delete
• [F] LocaleNumberFormatting.php
  Delete
• [F] Sanitizer.php
  Delete
• [F] SubmissionAggregate.php
  Delete
• [F] SubmissionAggregateCsvExportAdapter.php
  Delete