twigHow to prevent Server-Side Template Injection (SSTI) in PHP Twig?

Server-Side Template Injection (SSTI) is a type of attack that occurs when an attacker is able to inject malicious code into a web application template. To prevent SSTI in PHP Twig, it is important to use the built-in Twig escaping functions.

Example code

{{ user_input|escape }}

Output example

Escaped user input

The code above uses the escape filter to escape any user input before it is rendered in the template. This prevents malicious code from being executed.

It is also important to use the raw filter only when absolutely necessary, as it can be used to bypass the escaping functions.

Helpful links

• Twig Documentation - Escaping
• OWASP - Server-Side Template Injection

Edit this code on GitHub