title: Validation (vs) Sanitization in Symfony2+Twig?
body: <p>I need my users to enter the <strong>URI</strong> of their <strong>personal website</strong> in their profile so that other users can see and click on it. I am worried that this could lead to <strong>XSS attacks</strong> if the output is not sanitized properly. </p>
  
  <p><em>Like in this very simplistic schema below:</em></p>
  
  <hr>
  
  <p><img src="https://i.stack.imgur.com/cHjDr.png" alt="enter image description here"></p>
  
  <hr>
  
  <p>I am using the full stack <a href="http://symfony.com/" rel="noreferrer">symfony2 framework</a>, <a href="http://www.doctrine-project.org/" rel="noreferrer">Doctrine</a> as ORM and <a href="http://twig.sensiolabs.org/" rel="noreferrer">Twig</a> as a template engine. I know that Symfony provides some amazing <a href="http://symfony.com/doc/master/book/validation.html" rel="noreferrer">Validation tools</a>, and that TWIG provides <a href="http://twig.sensiolabs.org/doc/tags/autoescape.html" rel="noreferrer">automatic output escaping</a> (which is not necessary in this particular case) as well as <a href="http://twig.sensiolabs.org/doc/filters/index.html" rel="noreferrer">some filters for output sanitizing</a>. </p>
  
  <p>I've read the following about <a href="http://foaa.de/blog/2012/11/27/php-validation-and-sanitization/" rel="noreferrer">how symfony2 and twig handle sanitization</a>:</p>
  
  <blockquote>
    <p>Doctrine comes with sanitization for database
    (SQL) injections. Apart from this, there is no recommended / provided
    input sanitization at controller level in Symfony2. However, using Twig in the
    view, output sanitization is available.</p>
  </blockquote>
  
  <p>As an example, in <strong>CakePHP</strong> however:</p>
  
  <blockquote>
    <p>Data sanitization is implemented as a <a href="http://book.cakephp.org/2.0/en/core-utility-libraries/sanitize.html" rel="noreferrer">Utility</a> which can be
    accessed from anywhere (controller, component, model .. even view). It
    follows a sanitize-all-input approach with a fixed set of predefined
    sanitization filters. Sanitizing specific inputs with dedicated rules
    is possible, but seems not to be encouraged.The existing rules
    concentrate on SQL and HTML injections and filtering out general
    suspicious unicode characters.</p>
  </blockquote>
  
  <p><kbd>1</kbd> How do <code>symfony2 + twig</code> users handle <strong>input sanitization</strong>? Do they discard <strong>input sanitization</strong> totally and for example rely on <strong>validation</strong> only? Or do they write their own utility function to filter user inputs? or maybe use a library like <a href="https://code.google.com/p/owasp-esapi-php/" rel="noreferrer">owasp-esapi-php</a>?</p>
  
  <p><kbd>2</kbd> How do <code>symfony2 + twig</code> users handle <strong>output sanitization</strong>? Do they rely on the filters provided by the twig engine only? For example, are there already any tools that one can use to sanitize a user-entered URI, <a href="https://stackoverflow.com/questions/205923/best-way-to-handle-security-and-avoid-xss-with-user-entered-urls">something similar to this</a>?</p>
  
  <p><kbd>3</kbd> In this situarion, how would you handle database storage and display of a user-entered URI like in the example above, would you care about input sanitization at all? or would you use output sanitization only and store the URI as is?</p>