Forms, Validation and Output Escaping

<?php
// public/index.php
declare(strict_types=1);

require __DIR__ . '/../src/helpers.php';
require __DIR__ . '/../src/ReviewForm.php';

$book = ['id' => 1, 'title' => 'Kindred </script><b>'];        // a hostile title, to show escaping
$method = $_SERVER['REQUEST_METHOD'];
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);

if ($path === '/books/1/reviews/new' && $method === 'GET') {
    echo render('review-form', ['book' => $book, 'form' => new ReviewForm()]);
    return;
}

if ($path === '/books/1/reviews' && $method === 'POST') {
    $form = new ReviewForm();
    if (!$form->validate($_POST)) {
        http_response_code(422);                                  // Unprocessable Content
        echo render('review-form', ['book' => $book, 'form' => $form]);
        return;
    }
    // ... save the review (see "Databases with PDO"), then Post/Redirect/Get
    redirect('/books/1?reviewed=1');
}

http_response_code(404);
echo "Not found\n";

<?php
// src/helpers.php
declare(strict_types=1);

/** Escape for HTML text and quoted attribute values. */
function e(string|int|float|null $value): string
{
    return htmlspecialchars((string) $value, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5, 'UTF-8');
}

/** Render a PHP template with its own variables and return the HTML. */
function render(string $template, array $vars = []): string
{
    extract($vars, EXTR_SKIP);
    ob_start();
    require __DIR__ . "/../templates/$template.php";
    return ob_get_clean();
}

function redirect(string $path, int $status = 303): never
{
    header("Location: $path", true, $status);
    exit;
}

<?php
// src/ReviewForm.php
declare(strict_types=1);

final class ReviewForm
{
    private const array EXPECTED = ['rating', 'body', 'genres', 'email'];
    private const array GENRES = ['fiction', 'science-fiction', 'history', 'poetry'];

    /** @var array<string, string> */
    public array $errors = [];
    /** @var array<string, mixed> */
    public array $values = ['rating' => '', 'body' => '', 'genres' => [], 'email' => ''];

    public function validate(array $input): bool
    {
        // 1. Reject fields the form never had (mass-assignment and tampering)
        foreach (array_diff(array_keys($input), self::EXPECTED) as $field) {
            $this->errors[$field] = 'Unexpected field.';
        }

        // 2. Keep the raw values for redisplay ("sticky" form); escape them only on output
        $this->values['rating'] = (string) ($input['rating'] ?? '');
        $this->values['body'] = trim((string) ($input['body'] ?? ''));
        $this->values['genres'] = is_array($input['genres'] ?? null) ? $input['genres'] : [];
        $this->values['email'] = trim((string) ($input['email'] ?? ''));

        // 3. Validate each field: required, type, range, allowed values
        $rating = filter_var($this->values['rating'], FILTER_VALIDATE_INT,
            ['options' => ['min_range' => 1, 'max_range' => 5]]);
        if ($rating === false) {
            $this->errors['rating'] = 'Choose a rating from 1 to 5.';
        }
        if (mb_strlen($this->values['body']) < 10) {
            $this->errors['body'] = 'Write at least 10 characters.';
        }
        if (array_diff($this->values['genres'], self::GENRES) !== []) {
            $this->errors['genres'] = 'Unknown genre.';
        }
        if ($this->values['email'] !== '' && filter_var($this->values['email'], FILTER_VALIDATE_EMAIL) === false) {
            $this->errors['email'] = 'Enter a valid email address, or leave it empty.';
        }

        return $this->errors === [];
    }

    /** @return list<string> */
    public static function genres(): array
    {
        return self::GENRES;
    }
}

$ curl -w '\nstatus %{http_code}\n' -X POST localhost:8000/books/1/reviews \
    --data-urlencode 'rating=9' --data-urlencode 'body=<script>alert(1)</script>' \
    -d 'genres[]=poetry&genres[]=horror&is_admin=1' --data-urlencode 'email=ada@example.com'
      <li>is_admin: Unexpected field.</li>
      <li>rating: Choose a rating from 1 to 5.</li>
      <li>genres: Unknown genre.</li>
  <label>Review <textarea name="body">&lt;script&gt;alert(1)&lt;/script&gt;</textarea></label>
    <label>Email (optional) <input type="email" name="email" value="ada@example.com"></label>
status 422

$ curl -i -X POST localhost:8000/books/1/reviews -d 'rating=5&genres[]=fiction' --data-urlencode 'body=A remarkable novel.'
HTTP/1.1 303 See Other
Location: /books/1?reviewed=1

<?php /** @var ReviewForm $form */ /** @var array{id:int,title:string} $book */ ?>
<h1>Review <?= e($book['title']) ?></h1>

<?php if ($form->errors): ?>
  <ul class="errors">
  <?php foreach ($form->errors as $field => $message): ?>
    <li><?= e($field) ?>: <?= e($message) ?></li>
  <?php endforeach ?>
  </ul>
<?php endif ?>

<form method="post" action="/books/<?= (int) $book['id'] ?>/reviews">
  <label>Rating
    <select name="rating">
      <?php foreach (range(1, 5) as $n): ?>
        <option value="<?= $n ?>" <?= $form->values['rating'] === (string) $n ? 'selected' : '' ?>><?= $n ?></option>
      <?php endforeach ?>
    </select>
  </label>
  <label>Review <textarea name="body"><?= e($form->values['body']) ?></textarea></label>
  <?php foreach (ReviewForm::genres() as $genre): ?>
    <label><input type="checkbox" name="genres[]" value="<?= e($genre) ?>"
      <?= in_array($genre, $form->values['genres'], true) ? 'checked' : '' ?>> <?= e($genre) ?></label>
  <?php endforeach ?>
  <label>Email (optional) <input type="email" name="email" value="<?= e($form->values['email']) ?>"></label>
  <button>Send</button>
</form>
<a href="/search?<?= e(http_build_query(['q' => $book['title'], 'sort' => 'year'])) ?>">More like this</a>
<script>const book = <?= json_encode($book, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_THROW_ON_ERROR) ?>;</script>

<h1>Review Kindred &lt;/script&gt;&lt;b&gt;</h1>
...
<a href="/search?q=Kindred+%3C%2Fscript%3E%3Cb%3E&amp;sort=year">More like this</a>
<script>const book = {"id":1,"title":"Kindred <\/script><b>"};</script>

<?php
var_dump(filter_var('<b>Hi</b> & "you"', FILTER_SANITIZE_STRING));
// Deprecated: Constant FILTER_SANITIZE_STRING is deprecated since 8.1, use htmlspecialchars() instead
// string(18) "Hi & &#34;you&#34;"

<?php
declare(strict_types=1);

$email = "ada@example.com\r\nBcc: victim@example.net";        // from the form

// Array headers: PHP refuses CR and LF in header values
try {
    mail('editor@bookshelf.test', 'New review', 'Body', ['Reply-To' => $email]);
} catch (ValueError $e) {
    echo $e->getMessage(), "\n";
    // Header "Reply-To" contains CRLF characters that are used as a line separator and are not allowed in the header
}

// String headers: the injected Bcc goes through
mail('editor@bookshelf.test', 'New review', 'Body', "Reply-To: $email");

To: editor@bookshelf.test
Subject: New review
Reply-To: ada@example.com
Bcc: victim@example.net

Body