.. _zend.escaper.escaping-url:
Escaping URLs
=============
This method is basically an alias for PHP's ``rawurlencode()`` which has applied RFC 3986 since PHP 5.3. It is
included primarily for consistency.
URL escaping applies to data being inserted into a URL and not to the whole URL itself.
.. _zend.escaper.escaping-url.bad-examples:
Examples of Bad URL Escaping
----------------------------
XSS attacks are easy if data inserted into URLs is not escaped properly:
.. code-block:: php
:linenos:
Unescaped URL data
Click here!
.. _zend.escaper.escaping-url.good-examples:
Examples of Good URL Escaping
-----------------------------
By properly escaping data in URLs by using ``escapeUrl``, we can prevent XSS attacks:
.. code-block:: php
:linenos:
escapeUrl($input);
?>
Unescaped URL data
Click here!