A PHP security and hardening toolkit providing input validation, sanitization, and security utilities.
php-aegis provides a collection of security-focused utilities for PHP applications. Named after the mythological shield of Zeus, it aims to protect your applications from common web vulnerabilities.
-
Input Validation - Strict validation for emails, URLs, and common data formats
-
XSS Prevention - HTML sanitization with proper encoding
-
Type Safety - Full
strict_typesenforcement throughout -
Modern PHP - Requires PHP 8.1+ for latest security features
-
Zero Dependencies - Core library has no external dependencies
-
PSR-12 Compliant - Follows PHP-FIG coding standards
<?php
declare(strict_types=1);
use PhpAegis\Validator;
use PhpAegis\Sanitizer;
$validator = new Validator();
$sanitizer = new Sanitizer();
// Validate user input
$email = $_POST['email'] ?? '';
if (!$validator->email($email)) {
throw new InvalidArgumentException('Invalid email address');
}
// Sanitize for HTML output
$userContent = $_POST['comment'] ?? '';
$safeHtml = $sanitizer->html($userContent);
echo "<p>{$safeHtml}</p>";The Validator class provides strict input validation methods.
Validates email addresses using PHP’s FILTER_VALIDATE_EMAIL.
$validator = new Validator();
$validator->email('[email protected]'); // true
$validator->email('invalid'); // false
$validator->email(''); // falseThe Sanitizer class provides input sanitization for safe output.
Sanitizes strings for safe HTML output, preventing XSS attacks.
-
Encodes
<,>,&,",' -
Uses UTF-8 encoding
-
HTML5 compliant
$sanitizer = new Sanitizer();
$sanitizer->html('<script>alert("xss")</script>');
// Returns: <script>alert("xss")</script>
$sanitizer->html("It's safe & secure");
// Returns: It's safe & secure-
Validates input formats (email, URL, etc.)
-
Sanitizes output for HTML contexts
-
Enforces type safety
-
SQL injection prevention (use PDO prepared statements)
-
CSRF protection (use framework tokens)
-
Authentication/Authorization
-
Encryption/Hashing (use
password_hash(),sodium_*)
// Always validate before processing
if (!$validator->email($input)) {
// Reject early
return;
}
// Always sanitize before output
echo $sanitizer->html($userContent);
// Layer your defenses
$clean = $sanitizer->stripTags($input); // Remove tags
$safe = $sanitizer->html($clean); // Then encodePlanned features for future releases:
-
❏
Validator::ip()- IPv4/IPv6 validation -
❏
Validator::uuid()- UUID format validation -
❏
Validator::slug()- URL slug validation -
❏
Validator::phone()- Phone number validation
-
❏
Headers::csp()- Content Security Policy helper -
❏
Headers::hsts()- HSTS header helper -
❏
Headers::noSniff()- X-Content-Type-Options -
❏
Headers::frameOptions()- X-Frame-Options
-
❏
RateLimiter- Token bucket implementation -
❏ Redis/APCu backend support
-
wp-audit-toolkit - WordPress security auditing
-
proof-of-work - Proof-of-work spam prevention
MIT License - See LICENSE.txt for details.
Contributions welcome! Please read CONTRIBUTING.adoc first.
For security vulnerabilities, see SECURITY.adoc.
This repository follows Rhodium Standard Repository guidelines.
PHP is permitted under RSR as a Tier Exception for security-specific tooling.
