src/Core/Template.php
public function cleanXSS($value)
    {
        if (empty($value) || is_bool($value) || is_numeric($value)) {
            return $value;
        }

        if (is_array($value) || is_object($value)) {
            foreach ($value as $value_key => $value_item) {
                $value[$value_key] = $this->cleanXSS($value_item);
            }
            return $value;
        }

        // Remove all NULL bytes
        $value = str_replace("\0", '', $value);

        // Fix &entity\n;
        $value = str_replace(['&amp;', '&lt;', '&gt;'], ['&amp;amp;', '&amp;lt;', '&amp;gt;'], $value);
        $value = preg_replace('/(&#*\w+)[\x00-\x20]+;/u', '$1;', $value);
        $value = preg_replace('/(&#x*[0-9A-F]+);*/iu', '$1;', $value);
        $value = html_entity_decode($value, ENT_COMPAT, 'UTF-8');

        // Remove any attribute starting with "on" or xmlns
        $value = preg_replace('#(?:on[a-z]+|xmlns)\s*=\s*[\'"\x00-\x20]?[^\'>"]*[\'"\x00-\x20]?\s?#iu', '', $value);

        // Remove javascript: and vbscript: protocols
        $script_replace = [
            '#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu',
            '#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu',
            '#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u',
        ];
        $value = preg_replace($script_replace, '$1=$2[deleted]', $value);

        // Only works in IE: <span style="width: expression(alert('Ping!'));"></span>
        $expression_replace = [
            '#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#is',
            '#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#is',
            '#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#ius',
        ];
        $value = preg_replace($expression_replace, '$1>', $value);

        // Remove namespaced elements (we do not need them)
        $value = preg_replace('#</*\w+:\w[^>]*+>#i', '', $value);

        do {
            // Remove really unwanted tags
            $old = $value;
            $value = preg_replace(
                '#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i',
                '',
                $value
            );
        } while ($old !== $value);

        return $value;
    }
public function cleanXSS($value)
    {
        if (empty($value) || is_bool($value) || is_numeric($value)) {
            return $value;
        }

        if (is_array($value) || is_object($value)) {
            foreach ($value as $value_key => $value_item) {
                $value[$value_key] = $this->cleanXSS($value_item);
            }
            return $value;
        }

        // Remove all NULL bytes
        $value = str_replace("\0", '', $value);

        // Fix &entity\n;
        $value = str_replace(['&amp;', '&lt;', '&gt;'], ['&amp;amp;', '&amp;lt;', '&amp;gt;'], $value);
        $value = preg_replace('/(&#*\w+)[\x00-\x20]+;/u', '$1;', $value);
        $value = preg_replace('/(&#x*[0-9A-F]+);*/iu', '$1;', $value);
        $value = html_entity_decode($value, ENT_COMPAT, 'UTF-8');

        // Remove any attribute starting with "on" or xmlns
        $value = preg_replace('#(?:on[a-z]+|xmlns)\s*=\s*[\'"\x00-\x20]?[^\'>"]*[\'"\x00-\x20]?\s?#iu', '', $value);

        // Remove javascript: and vbscript: protocols
        $script_replace = [
            '#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu',
            '#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu',
            '#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u',
        ];
        $value = preg_replace($script_replace, '$1=$2[deleted]', $value);

        // Only works in IE: <span style="width: expression(alert('Ping!'));"></span>
        $expression_replace = [
            '#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#is',
            '#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#is',
            '#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#ius',
        ];
        $value = preg_replace($expression_replace, '$1>', $value);

        // Remove namespaced elements (we do not need them)
        $value = preg_replace('#</*\w+:\w[^>]*+>#i', '', $value);

        do {
            // Remove really unwanted tags
            $old = $value;
            $value = preg_replace(
                '#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i',
                '',
                $value
            );
        } while ($old !== $value);

        return $value;
    }
@param mixed $value

@return mixed