Core Security Hardening and Anti-XSS Pipelines

Zero CMS Security Philosophy

Security in Zero CMS is baked directly into the core kernel class handlers. By rejecting massive, third-party libraries, we eliminate the primary attack vector of modern PHP applications (upstream package exploits). Every protection pipeline—including CSRF token validation, input sanitization, HTML scrubbers, and spam traps—is written natively, keeping the system extremely fast, transparent, and secure.

1. CSRF Protection (Security::csrfVerify)

To protect against Cross-Site Request Forgery (CSRF) attacks, Zero CMS automatically generates a secure, random state token for each session. Form submissions must embed this token. State-changing HTTP request routes (POST, PUT, DELETE) are intercepted by CsrfMiddleware, which calls Security::csrfVerify(). If the token is invalid or missing, the request is dropped immediately before any database writes are triggered.

CSRF Form Generation & Verification

CSRF Form Generation & Verification php

// 1. Form view template helper generates the input
echo \Zero\Support\Security::csrfInput();
// Output: <input type="hidden" name="csrf" value="a1f9e8...">

// 2. Middleware validates token before processing inputs
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $token = $_POST['csrf'] ?? '';
    if (!\Zero\Support\Security::csrfVerify($token)) {
        header('HTTP/1.1 403 Forbidden');
        die('Invalid CSRF handshake token.');
    }
}

2. Input Sanitization & HTML DOM Scrubbing

Zero CMS employs double-walled defenses against Cross-Site Scripting (XSS). Incoming scalar values are recursively sanitized by Security::sanitizeInput() to strip standard HTML tags and null bytes. Rich text data (which must support HTML layouts) is scrubbed using Security::sanitizeHtml(). This sanitizer uses PHP's native DOMDocument and DOMXPath to parse the HTML string, completely removing blacklisted tags (<script>, <iframe>, <embed>, etc.) and dangerous event attributes (e.g. onclick, onload) natively.

Global HTML Sanitizer (Security.php)

Global HTML Sanitizer (Security.php) php

namespace Zero\Support;

class Security {
    public static function sanitizeHtml(string $html): string {
        // Uses native DOMDocument and DOMXPath to purge scripts and event listeners...
        $doc = new \DOMDocument();
        $doc->loadHTML('<?xml encoding="utf-8" ?>' . $html, LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD);
        // Strips script, iframe, meta, form, style, and strips attributes with 'javascript:' or 'on*' ...
        return trim($doc->saveHTML());
    }
}

3. Stealth Honeypot Spam Prevention

Dynamic forms on our sites use zero-friction stealth honeypots to block automated spam bots. A hidden input named website_url is embedded inside the form. Bots are highly primed to fill this field. To prevent bot detection, the word 'honeypot' never appears in the class names, inputs, or styles. Instead, a standard-looking wrapper class (.website-field-wrapper) is styled with display: none; visibility: hidden; on CSS sheets to hide the field from human eyes. If the bait field is populated upon submission, the request is silently dropped, returning a simulated success response to the bot without executing any database writes or dispatching emails.