From aaa827263b5c046a1288c8848fe4a35a40759ca6 Mon Sep 17 00:00:00 2001 From: thisispiers <1831251+thisispiers@users.noreply.github.com> Date: Fri, 21 Jul 2023 10:18:56 +0100 Subject: [PATCH] Fix JavaScript Unicode escape sequences --- Escape.php | 2 +- composer.json | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/Escape.php b/Escape.php index 346e9d5..0296263 100644 --- a/Escape.php +++ b/Escape.php @@ -37,7 +37,7 @@ public static function encode( if ($format === 'html') { $encoded_data .= '&#x' . $hex . ';'; } else if ($format === 'unicode') { - $encoded_data .= '\\u' . $ord; + $encoded_data .= '\\u{' . $hex . '}'; } else if ($format === 'css') { $hex = str_pad($hex, 6, '0', \STR_PAD_LEFT); $encoded_data .= '\\' . $hex; diff --git a/composer.json b/composer.json index 3d37014..e38bf35 100644 --- a/composer.json +++ b/composer.json @@ -2,6 +2,7 @@ "name": "thisispiers/xss-escape", "description": "A PHP implementation of OWASP Cross Site Scripting Prevention Cheat Sheet", "license": "LGPL-3.0-only", + "version": "1.0.1", "require": { "php": ">=7.1", "ext-mbstring": "*"