A PHP security and hardening toolkit providing input validation, sanitization, and security utilities.
php-aegis is the nearest thing in this portfolio to a publishable security utility, but it is not yet a finished public release.
Core validation, sanitization, headers, and Turtle escaping are implemented.
Remaining work is concentrated in release evidence rather than broad architecture:
complete the remaining critical tests
execute and publish validation evidence for the headline claims
complete packaging and publication work
Use PRIORITY.adoc and validation/FINDINGS-AND-RECOMMENDATIONS.md together when judging readiness.
php-aegis provides a collection of security-focused utilities for PHP applications. Named after the mythological shield of Zeus, it aims to protect your applications from common web vulnerabilities.
API services without view layers
CLI tools and microservices
Semantic web applications (RDF/Turtle escaping - unique to php-aegis)
Vanilla PHP applications without frameworks
Framework gaps - validation/features that WordPress/Laravel/Symfony lack
WordPress plugins/themes - Use WordPress core functions (
esc_html(),esc_attr(), etc.)Laravel views - Use Blade’s auto-escaping
Symfony/Twig - Use Twig’s escaping
See POSITIONING.md for detailed guidance.
Input Validation - Strict validation for emails, URLs, IPs, UUIDs, and more
Context-Aware Sanitization - HTML, JS, CSS, URL, and JSON output escaping
Security Headers - Easy CSP, HSTS, X-Frame-Options, and more
Rate Limiting - Planned and partially documented, but not yet a release-complete core feature
IndieWeb Security - Important roadmap area; implementation and validation depth still need to catch up to the docs
RDF/Turtle Escaping - Unique W3C-compliant semantic web security (no other PHP lib does this)
Cerro Torre Integration - Verified container packaging with cryptographic provenance
WordPress Integration - 23 adapter functions + MU-plugin
Type Safety - Full
strict_typesenforcement throughoutModern PHP - Requires PHP 8.1+ for latest security features
Zero Dependencies - Core library has no external dependencies
PSR-12 Compliant - Follows PHP-FIG coding standards
git clone https://github.com/hyperpolymath/php-aegis.git
cd php-aegis
composer installPackagist publication is still pending. Do not assume composer require hyperpolymath/php-aegis works until the release and publication tasks in PRIORITY.adoc are complete.
<?phpdeclare(strict_types=1);
usePhpAegis\Validator;
usePhpAegis\Sanitizer;
usePhpAegis\Headers;
// Apply security headers (call before any output)
Headers::secure();
// Validate user input$email = $_POST['email'] ?? '';
if (!Validator::email($email)) {
thrownewInvalidArgumentException('Invalid email address');
}
// Sanitize for HTML output$userContent = $_POST['comment'] ?? '';
$safeHtml = Sanitizer::html($userContent);
echo"<p>{$safeHtml}</p>";<?phpusePhpAegis\TurtleEscaper;
// Safe Turtle string literal$label = TurtleEscaper::string($userInput);
echo'"' . $label . '"@en';
// Safe IRI$uri = TurtleEscaper::iri($userProvidedUri);
echo'<' . $uri . '>';
// Complete tripleecho TurtleEscaper::triple(
'https://example.org/resource/1',
'http://www.w3.org/2000/01/rdf-schema#label',
$userLabel,
'en'
);The Validator class provides strict input validation methods (all static).
Validator::email('user@example.com'); // true
Validator::url('https://example.com'); // true
Validator::httpsUrl('http://insecure'); // false (requires HTTPS)Validator::ip('192.168.1.1'); // true (v4 or v6)
Validator::ipv4('192.168.1.1'); // true
Validator::ipv6('::1'); // trueValidator::uuid('550e8400-e29b-41d4-a716-446655440000'); // true
Validator::slug('my-post-title'); // true
Validator::json('{"valid": true}'); // true
Validator::int('42'); // true
Validator::int('5', min: 1, max: 10); // true
Validator::domain('example.com'); // true
Validator::hostname('example.com'); // true (domain or IP)
Validator::semver('1.2.3-beta.1'); // true
Validator::iso8601('2024-01-15T10:30:00Z'); // true
Validator::hexColor('#ff5733'); // trueThe Sanitizer class provides context-aware output escaping (all static).
Sanitizer::html('<script>alert("xss")</script>');
// Returns: <script>alert("xss")</script>
Sanitizer::stripTags('<p>Hello <b>World</b></p>');
// Returns: Hello WorldSecurity headers helper (call before output).
// Apply all recommended headers at once
Headers::secure();
// Or configure individually
Headers::contentSecurityPolicy([
'default-src' => ["'self'"],
'script-src' => ["'self'", 'https://cdn.example.com'],
'style-src' => ["'self'", "'unsafe-inline'"],
]);
Headers::strictTransportSecurity(maxAge: 31536000, preload: true);
Headers::frameOptions('SAMEORIGIN');
Headers::referrerPolicy('strict-origin-when-cross-origin');
Headers::permissionsPolicy([
'geolocation' => [],
'camera' => [],
]);
Headers::removeInsecureHeaders(); // Removes X-Powered-By, ServerW3C-compliant RDF Turtle escaping for semantic web applications.
// Escape string literals
TurtleEscaper::string('Hello "World"');
// Returns: Hello \"World\"// Escape IRIs
TurtleEscaper::iri('https://example.org/resource#1');
// Build complete literals with language/datatype
TurtleEscaper::literal('Bonjour', language: 'fr');
// Returns: "Bonjour"@fr
TurtleEscaper::literal('42', datatype: 'http://www.w3.org/2001/XMLSchema#integer');
// Returns: "42"^^xsd:integer// Build complete triples
TurtleEscaper::triple(
'https://example.org/person/1',
'http://xmlns.com/foaf/0.1/name',
'Alice',
'en'
);
// Returns: <https://example.org/person/1> <http://xmlns.com/foaf/0.1/name> "Alice"@en .Validates input formats (email, URL, etc.)
Sanitizes output for HTML contexts
Enforces type safety
SQL injection prevention (use PDO prepared statements)
CSRF protection (use framework tokens)
Authentication/Authorization
Encryption/Hashing (use
password_hash(),sodium_*)
// Always validate before processingif (!$validator->email($input)) {
// Reject earlyreturn;
}
// Always sanitize before outputecho$sanitizer->html($userContent);
// Layer your defenses$clean = $sanitizer->stripTags($input); // Remove tags$safe = $sanitizer->html($clean); // Then encodeSee ROADMAP_PRIORITY.md for the detailed, integration-informed roadmap.
✓ Extended validators (IP, UUID, slug, JSON, filename safety)
✓ Context-aware sanitizers (JS, CSS, URL, JSON, filename)
✓ Security headers module (CSP, HSTS, X-Frame-Options, etc.)
✓ RDF/Turtle escaping (unique differentiator)
✓ Static methods (no instance required)
✓ SPDX license headers
sanctify-php - Static analysis for PHP security (complementary tool)
wp-audit-toolkit - WordPress security auditing
proof-of-work - Proof-of-work spam prevention
For teams using both php-aegis and sanctify-php, see HANDOVER_SANCTIFY.md for integration guidance and coordinated workflows.
MIT License - See LICENSE.txt for details.
Contributions welcome! Please read CONTRIBUTING.adoc first.
For security vulnerabilities, see SECURITY.adoc.
This repository follows Rhodium Standard Repository guidelines.
PHP is permitted under RSR as a Tier Exception for security-specific tooling.
See TOPOLOGY.md for a visual architecture map and completion dashboard.