@sun-asterisk/sunlint 1.3.39 → 1.3.41

package/skill-assets/sunlint-code-quality/rules/php/S007-output-encoding.md

@@ -0,0 +1,61 @@
+---
+title: Output Encoding Before Interpreter Use
+impact: HIGH
+impactDescription: prevents XSS and other injection attacks in the browser
+tags: xss, encoding, output, html, security, php
+---
+
+## Output Encoding Before Interpreter Use
+
+Cross-Site Scripting (XSS) and other injection attacks occur when unescaped user-controlled data is interpreted as code by the browser. All data must be encoded or escaped according to the context where it is being displayed.
+
+**Incorrect (no encoding):**
+
+```php
+// XSS vulnerability in plain PHP
+echo "<h1>Results for: " . $_GET['q'] . "</h1>";
+
+// Blade "unescaped" output for user input
+{!! $userInput !!} 
+
+// Injecting into JavaScript without encoding
+echo "<script>const name = '" . $userName . "';</script>";
+// Attacker in $userName: '; alert(1); //
+```
+
+**Correct (context-aware encoding):**
+
+```php
+// 1. HTML Body context (plain PHP)
+echo "<h1>Results for: " . htmlspecialchars($_GET['q'], ENT_QUOTES, 'UTF-8') . "</h1>";
+
+// 2. Blade (Recommended)
+// Auto-escapes using htmlspecialchars internally
+<h1>Results for: {{ $query }}</h1>
+
+// 3. If you MUST output HTML, use a sanitizer (e.g. HTML Purifier)
+$purifier = new HTMLPurifier();
+echo $purifier->purify($userHtml);
+
+// 4. JavaScript context
+// Always use json_encode for passing data to JS
+?>
+<script>
+    const name = <?php echo json_encode($userName); ?>;
+</script>
+<?php
+
+// 5. URL context
+$url = "/profile?user=" . urlencode($username);
+```
+
+**Encoding by Context:**
+
+| Context | Encoding Method | Result Example |
+|---------|-----------------|----------------|
+| **HTML Body** | `htmlspecialchars()` | `<` becomes `&lt;` |
+| **HTML Attribute** | `htmlspecialchars(..., ENT_QUOTES)` | `"` becomes `&quot;` |
+| **JavaScript** | `json_encode()` | String becomes `"string"` with quotes |
+| **URL Parameter** | `urlencode()` | Spaces become `+` or `%20` |
+
+**Tools:** HTML Purifier, Blade Template Engine, PHP_CodeSniffer, SonarQube

package/skill-assets/sunlint-code-quality/rules/php/S009-approved-crypto.md

@@ -0,0 +1,53 @@
+---
+title: Use Only Approved Crypto Algorithms
+impact: MEDIUM
+impactDescription: ensures cryptographic strength and resistance to collision or brute-force attacks
+tags: cryptography, algorithms, hashing, encryption, security, php
+---
+
+## Use Only Approved Crypto Algorithms
+
+Weak cryptographic algorithms like MD5, SHA-1, DES, and AES-ECB are either broken or have known vulnerabilities that make them insecure for modern applications. Always use industry-standard, approved algorithms for hashing and encryption.
+
+**Incorrect (weak algorithms):**
+
+```php
+// WEAK hash (MD5 is broken)
+$hash = md5($password);
+
+// WEAK encryption mode (ECB mode does not provide semantic security)
+$encrypted = openssl_encrypt($data, 'aes-256-ecb', $key);
+
+// WEAK algorithm
+$encrypted = openssl_encrypt($data, 'des-ede3', $key); // 3DES is deprecated
+```
+
+**Correct (approved algorithms):**
+
+```php
+// 1. Password Hashing (Always use password_hash)
+$hash = password_hash($password, PASSWORD_ARGON2ID); // Recommended: Argon2id or BCRYPT
+$isValid = password_verify($password, $hash);
+
+// 2. Data Integrity (non-password)
+$hash = hash('sha256', $data);
+
+// 3. Strong Authenticated Encryption (GCM mode)
+$iv = random_bytes(openssl_cipher_iv_length('aes-256-gcm'));
+$tag = "";
+$encrypted = openssl_encrypt($data, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag);
+// Store $iv, $tag, and $encrypted
+```
+
+**Approved vs Prohibited:**
+
+| Purpose | Approved | Prohibited |
+|---------|----------|------------|
+| **Data Hashing** | SHA-256, SHA-3, BLAKE2 | MD5, SHA-1 |
+| **Encryption** | AES-256-GCM, AES-256-CBC (with HMAC) | AES-ECB, DES, 3DES, RC4 |
+| **Passwords** | Argon2id, BCRYPT | MD5, SHA-256, Plain Encryption |
+
+**Best Practice:**
+Never roll your own crypto. Use high-level libraries like `libsodium` (built-in to PHP 7.2+) if you need advanced features. For passwords, **only** use the native `password_hash()` functions.
+
+**Tools:** PHPStan (check for md5/sha1), SonarQube (S2070, S4790), Semgrep

package/skill-assets/sunlint-code-quality/rules/php/S010-csprng.md

@@ -0,0 +1,47 @@
+---
+title: Use CSPRNG For Security Purposes
+impact: HIGH
+impactDescription: prevents predictable tokens and session hijacking
+tags: random, csprng, tokens, session, cryptography, security, php
+---
+
+## Use CSPRNG For Security Purposes
+
+Non-cryptographic random generators like `rand()` or `mt_rand()` are predictable. Attackers can guess session tokens, OTPs, and password reset links if they are generated with weak random sources.
+
+**Incorrect (predictable random):**
+
+```php
+// INSECURE - predictable!
+$sessionId = md5(rand());
+
+// INSECURE - mt_rand() is faster but not cryptographically secure
+$otp = mt_rand(100000, 999999);
+
+// INSECURE - uniqid() is based on current time in microseconds
+$resetToken = uniqid('token_', true);
+```
+
+**Correct (cryptographically secure):**
+
+```php
+// Cryptographically secure session ID or token
+$token = bin2hex(random_bytes(32)); // 256-bit entropy
+
+// Secure OTP generation
+$otp = random_int(100000, 999999);
+
+// Using Laravel's Str helper (which uses random_bytes internally)
+use Illuminate\Support\Str;
+$token = Str::random(40);
+```
+
+**CSPRNG by language (Update):**
+
+| Language | Secure | Insecure |
+|----------|--------|----------|
+| PHP7+    | `random_bytes()`, `random_int()` | `rand()`, `mt_rand()`, `uniqid()` |
+| Node.js  | `crypto.randomBytes()` | `Math.random()` |
+| Python   | `secrets`, `os.urandom()` | `random` |
+
+**Tools:** PHPStan (extension-installer), Psalm, SonarQube (S2245), Semgrep

package/skill-assets/sunlint-code-quality/rules/php/S011-encrypted-client-hello.md

@@ -0,0 +1,41 @@
+---
+title: Enable Encrypted Client Hello (ECH)
+impact: MEDIUM
+impactDescription: protects Server Name Indication (SNI) from eavesdropping
+tags: tls, ech, sni, privacy, security, infrastructure, php
+---
+
+## Enable Encrypted Client Hello (ECH)
+
+Encrypted Client Hello (ECH) is a TLS extension that encrypts the entire `ClientHello` message during the TLS handshake. This prevents network eavesdroppers from seeing the Server Name Indication (SNI), essentially hiding the specific domain name you are visiting.
+
+**Infrastructure Configuration:**
+
+ECH is typically handled at the web server (Nginx/Apache) or CDN level (Cloudflare), not directly in PHP code.
+
+**1. Nginx Configuration (where supported):**
+
+```nginx
+# Future-facing Nginx configuration
+ssl_ech on;
+ssl_ech_key /etc/nginx/ssl/ech-key.pem;
+```
+
+**2. DNS Configuration:**
+
+You must publish an `HTTPS` or `SVCB` DNS record containing the ECH configuration string:
+
+```text
+# Example HTTPS record with ECH data
+example.com. IN HTTPS 1 . alpn="h2" ech="<base64-ech-config>"
+```
+
+**How it works with PHP:**
+PHP applications benefit from ECH transparently when served behind a compatible reverse proxy or CDN. No changes are required to the PHP logic itself, but developers should advocate for its use in production environments to improve user privacy.
+
+**Current Support State:**
+- **Cloudflare**: Provides one-click ECH support.
+- **Browsers**: Chrome and Firefox have experimental or rolling support.
+- **Privacy**: Crucial for bypassing censorship and preventing DNS/SNI-based tracking.
+
+**Tools:** Cloudflare, NGINX (with ECH patches), DigiCert, DNS management

package/skill-assets/sunlint-code-quality/rules/php/S012-secrets-management.md

@@ -0,0 +1,60 @@
+---
+title: Use Secrets Management For Backend Secrets
+impact: CRITICAL
+impactDescription: centralizes and secures credential storage
+tags: secrets, vault, credentials, configuration, security, php
+---
+
+## Use Secrets Management For Backend Secrets
+
+Hardcoded secrets (API keys, database passwords, tokens) are exposed in version control and can be accessed by anyone with code access. Use dedicated secrets management systems or environment variables that are not committed to the repository.
+
+**Incorrect (hardcoded or plain env files):**
+
+```php
+// Hardcoded in code
+define('API_KEY', 'sk-abc123xyz789');
+
+// Hardcoded in a config file
+$config = [
+    'db' => [
+        'password' => 'super-secret-password'
+    ]
+];
+
+// .env file committed to repo (vulnerable)
+// DB_PASSWORD=password123
+```
+
+**Correct (secrets management):**
+
+```php
+// Using environment variables (not committed to VCS)
+$dbPassword = getenv('DB_PASSWORD');
+
+// In Laravel (using .env which is in .gitignore)
+$password = env('DB_PASSWORD');
+// Or via config (Recommended)
+$stripeKey = config('services.stripe.key');
+
+// Using a dedicated Secrets Manager (e.g., AWS Secrets Manager via SDK)
+use Aws\SecretsManager\SecretsManagerClient;
+
+$client = new SecretsManagerClient(['region' => 'us-east-1']);
+$result = $client->getSecretValue(['SecretId' => 'prod/db/password']);
+$dbPassword = $result['SecretString'];
+
+// Validation at startup
+if (!$dbPassword) {
+    throw new \RuntimeException('DATABASE_URL environment variable is required but not set.');
+}
+```
+
+**Best practices:**
+1. Never commit `.env` files or hardcoded secrets to version control.
+2. Use a `.env.example` to document required variables without real data.
+3. Use secrets rotation for critical credentials.
+4. Audit access to your production secrets.
+5. Use different secrets for development, staging, and production environments.
+
+**Tools:** HashiCorp Vault, AWS Secrets Manager, Dotenv PHP, SonarQube

package/skill-assets/sunlint-code-quality/rules/php/S013-tls-connections.md

@@ -0,0 +1,67 @@
+---
+title: Always Use TLS For All Connections
+impact: HIGH
+impactDescription: protects data in transit from eavesdropping and man-in-the-middle attacks
+tags: tls, https, encryption, transport, security, php
+---
+
+## Always Use TLS For All Connections
+
+Unencrypted data (HTTP, plain SQL, plain Redis) is easily intercepted by anyone on the network path. You must enforce TLS for all external and internal communications.
+
+**Incorrect (unencrypted connections):**
+
+```php
+// 1. Plain HTTP API calls
+$data = file_get_contents("http://api.example.com/data");
+
+// 2. Database without encryption
+$pdo = new PDO("mysql:host=db.example.com;dbname=test", "user", "pass");
+
+// 3. Unencrypted Redis
+$redis = new Redis();
+$redis->connect('redis.example.com', 6379);
+```
+
+**Correct (TLS everywhere):**
+
+```php
+// 1. HTTPS for APIs
+$data = file_get_contents("https://api.example.com/data");
+
+// 2. Database with TLS (PDO MySQL)
+$pdo = new PDO(
+    "mysql:host=db.example.com;dbname=test", 
+    "user", "pass",
+    [
+        PDO::MYSQL_ATTR_SSL_CA => '/path/to/ca-cert.pem',
+        PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => true,
+    ]
+);
+
+// 3. Redis with TLS (PhpRedis)
+$redis = new Redis();
+$redis->connect('tls://redis.example.com', 6380, 1.5, NULL, 0, 0, [
+    'stream' => [
+        'cafile' => '/path/to/ca-cert.pem',
+        'verify_peer' => true,
+    ],
+]);
+
+// 4. Force HTTPS in Application (Laravel Middleware)
+if (! $request->secure() && App::environment('production')) {
+    return redirect()->secure($request->getRequestUri());
+}
+
+// 5. HSTS Header
+header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");
+```
+
+**Checklist:**
+- [ ] All external API calls use `https://`.
+- [ ] Database connections use SSL/TLS attributes.
+- [ ] Redis/Cache connections use `tls://`.
+- [ ] HSTS headers are enabled in production.
+- [ ] Web server (Nginx/Apache) redirects all HTTP traffic to HTTPS.
+
+**Tools:** OWASP ZAP, SSLyze, Qualys SSL Labs, PHPUnit (to verify connection stubs)

package/skill-assets/sunlint-code-quality/rules/php/S016-no-sensitive-query-string.md

@@ -0,0 +1,61 @@
+---
+title: Do Not Pass Sensitive Data In Query String
+impact: HIGH
+impactDescription: prevents sensitive information leakage in logs, browser history, and diagnostic tools
+tags: url, query-string, sensitive-data, leakage, security, php
+---
+
+## Do Not Pass Sensitive Data In Query String
+
+URL query strings are stored in browser history, web server access logs, proxy/CDN logs, and are passed in the `Referer` header to external sites. Sensitive information like tokens, passwords, or PII (Personally Identifiable Information) in a URL is practically public.
+
+**Incorrect (sensitive data in URL):**
+
+```php
+// Passing token in GET parameter
+$response = file_get_contents("https://api.example.com/data?api_key=" . $apiKey);
+
+// Login via GET (Very Dangerous)
+// GET /login.php?user=admin&password=secret123
+
+// Passing sensitive PII
+// GET /user/details?ssn=123-45-678
+```
+
+**Correct (sensitive data in Headers or Request Body):**
+
+```php
+// 1. Passing tokens in Authorization Header
+$context = stream_context_create([
+    'http' => [
+        'header' => "Authorization: Bearer " . $accessToken
+    ]
+]);
+$response = file_get_contents("https://api.example.com/data", false, $context);
+
+// 2. Sensitive data in POST Request Body
+// (Using Guzzle for clarity)
+$client->post('/login', [
+    'form_params' => [
+        'user' => 'admin',
+        'password' => $password
+    ]
+]);
+
+// 3. One-time tokens in POST forms
+?>
+<form action="/reset-password" method="POST">
+    <input type="hidden" name="token" value="<?php echo htmlspecialchars($secureToken); ?>">
+    <input type="password" name="new_password">
+    <button type="submit">Reset</button>
+</form>
+<?php
+```
+
+**Where query strings leak:**
+- **Web Server Logs**: Apache/Nginx logs store the full URL including query strings.
+- **Browser History**: Users can see sensitive tokens in their history.
+- **Referer Header**: If a page with a token in the URL links to an external image or site, that site receives the token.
+- **Proxy/WAF logs**: Intermediate network devices log URLs.
+
+**Tools:** Semgrep, SonarQube, Manual Review, OWASP ZAP (to detect sensitive data in URLs)

package/skill-assets/sunlint-code-quality/rules/php/S017-parameterized-queries.md

@@ -0,0 +1,44 @@
+---
+title: Always Use Parameterized Queries
+impact: CRITICAL
+impactDescription: prevents SQL injection attacks
+tags: injection, sql, database, parameterized, security, php
+---
+
+## Always Use Parameterized Queries
+
+SQL injection is one of the top security vulnerabilities in PHP applications. Direct string concatenation or using variables directly in SQL strings allows attackers to execute arbitrary database commands, steal data, or destroy databases.
+
+**Incorrect (string concatenation):**
+
+```php
+// SQL Injection vulnerability
+$userId = $_GET['id'];
+$query = "SELECT * FROM users WHERE id = '" . $userId . "'";
+$result = $conn->query($query);
+
+// Attacker input: ' OR '1'='1
+// Resulting query: SELECT * FROM users WHERE id = '' OR '1'='1'
+// Returns ALL users!
+```
+
+**Correct (parameterized queries):**
+
+```php
+// Using PDO (Recommended)
+$userId = $_GET['id'];
+$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");
+$stmt->execute(['id' => $userId]);
+$user = $stmt->fetch();
+
+// Using MySQLi (Prepared Statements)
+$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");
+$stmt->bind_param("s", $userId);
+$stmt->execute();
+$result = $stmt->get_result();
+
+// Using Laravel Eloquent (Safe by default)
+$user = User::where('id', $userId)->first();
+```
+
+**Tools:** PHPStan (DBA extension), SonarQube (S2077, S3649), Psalm, Semgrep

package/skill-assets/sunlint-code-quality/rules/php/S019-email-input-sanitization.md

@@ -0,0 +1,54 @@
+---
+title: Sanitize Input Before Sending Emails
+impact: MEDIUM
+impactDescription: prevents email header injection and spam abuse
+tags: email, injection, sanitization, input-validation, security, php
+---
+
+## Sanitize Input Before Sending Emails
+
+Email header injection vulnerabilities occur when an attacker can inject newline characters (`\r` or `\n`) into email headers like `Subject`, `To`, or `From`. This allows them to add unauthorized `Bcc:` or `Cc:` recipients, effectively turning your system into a spam relay.
+
+**Incorrect (unsanitized email input):**
+
+```php
+// VULNERABLE: Direct use of user input in mail() headers
+$subject = $_POST['subject']; // Input: "Question\r\nBcc: victim@example.com"
+$to = "admin@example.com";
+$message = "User message...";
+
+mail($to, $subject, $message); // Attacker successfully sent Bcc to victim!
+```
+
+**Correct (sanitized email fields):**
+
+```php
+function sanitizeEmailHeader($input) {
+    // Remove carriage returns and line feeds to prevent header injection
+    return str_replace(["\r", "\n", "\t"], ' ', $input);
+}
+
+$to = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
+if (!$to) {
+    die("Invalid email address");
+}
+
+$subject = sanitizeEmailHeader($_POST['subject']);
+$message = $_POST['message'];
+
+// 1. Using native mail() with sanitized input
+mail($to, $subject, $message);
+
+// 2. Using Laravel Mail (Recommended)
+// Laravel's Mailer and SwiftMailer/Symfony Mailer automatically sanitize headers.
+// However, validation of addresses is still mandatory.
+Mail::to($to)->send(new ContactRequest($subject, $message));
+```
+
+**Security Checklist:**
+1. **Validate** email addresses using `FILTER_VALIDATE_EMAIL`.
+2. **Sanitize** any user input used in headers (Subject, From, CC, BCC) by removing CRLF characters.
+3. **Use Modern Libraries** like PHPMailer or Symfony Mailer which provide built-in protection against header injection.
+4. **Rate Limit** email sending to prevent mass spamming if an account is compromised.
+
+**Tools:** PHPStan, Psalm, SonarQube, Manual Security Review

package/skill-assets/sunlint-code-quality/rules/php/S020-eval-code-execution.md

@@ -0,0 +1,57 @@
+---
+title: Avoid Eval Or Dynamic Code Execution
+impact: HIGH
+impactDescription: prevents remote code execution vulnerabilities
+tags: eval, code-execution, rce, injection, security, php
+---
+
+## Avoid Eval Or Dynamic Code Execution
+
+`eval()`, `exec()`, `system()`, and similar functions execute arbitrary code or shell commands. Using these with user-controlled input makes the application extremely vulnerable to Remote Code Execution (RCE).
+
+**Incorrect (dynamic code execution):**
+
+```php
+// eval() with user input
+$formula = $_POST['formula'];
+eval('$result = ' . $formula . ';');  // RCE vulnerability!
+
+// system() or exec() with unsanitized input
+system("ls -l " . $_GET['dir']); // Command injection!
+
+// create_function() with user input (Deprecated)
+$func = create_function('$a', 'return ' . $_POST['logic'] . ';');
+
+// Dangerous unserialize with user input
+$data = unserialize($_POST['data']); // Object injection vulnerability
+```
+
+**Correct (safe alternatives):**
+
+```php
+// Use a dedicated library for expression parsing (e.g., symfony/expression-language)
+use Symfony\Component\ExpressionLanguage\ExpressionLanguage;
+
+$expressionLanguage = new ExpressionLanguage();
+$result = $expressionLanguage->evaluate($formula, ['a' => 10]);
+
+// Use an allowlist for commands
+$allowedDirs = ['uploads', 'public'];
+$dir = $_GET['dir'];
+if (in_array($dir, $allowedDirs)) {
+    $safeDir = escapeshellarg($dir);
+    system("ls -l " . $safeDir);
+}
+
+// Use JSON for data exchange (instead of serialize)
+$data = json_decode($_POST['data'], true);
+
+// For dynamic inclusion, use an allowlist
+$allowedPages = ['home', 'contact', 'about'];
+$page = $_GET['page'];
+if (in_array($page, $allowedPages)) {
+    require_once "pages/" . $page . ".php";
+}
+```
+
+**Tools:** PHPStan (disallow-eval), Psalm, SonarQube (S1523), Semgrep

package/skill-assets/sunlint-code-quality/rules/php/S022-context-escaping.md

@@ -0,0 +1,58 @@
+---
+title: Escape Data By Output Context
+impact: MEDIUM
+impactDescription: ensures correct encoding for each output context to prevent XSS and injection
+tags: xss, escaping, context, encoding, security, php
+---
+
+## Escape Data By Output Context
+
+Using the wrong escaping strategy for a given context is a common security mistake. For example, using HTML encoding (`htmlspecialchars`) inside a JavaScript block or in an HTTP header does not provide adequate protection.
+
+**Incorrect (wrong encoding for specific context):**
+
+```php
+$input = $_GET['user']; // Attacker input: "; alert(1); //
+
+// WRONG: Using HTML escaping in a JavaScript context
+$escaped = htmlspecialchars($input);
+echo "<script>var name = '{$escaped}';</script>"; 
+// Result: var name = '&quot;; alert(1); //'; -> Still potentially breaks logic or remains vulnerable
+
+// WRONG: No sanitization for HTTP headers
+header("X-Custom-Data: " . $input); // Header injection via CRLF
+```
+
+**Correct (context-appropriate encoding):**
+
+```php
+// 1. HTML Body Context
+echo "<div>" . htmlspecialchars($input, ENT_QUOTES, 'UTF-8') . "</div>";
+
+// 2. JavaScript Context (Always use JSON encoding)
+$jsonInput = json_encode($input);
+echo "<script>var name = {$jsonInput};</script>";
+
+// 3. URL Context
+echo "<a href='/profile?name=" . urlencode($input) . "'>View</a>";
+
+// 4. HTTP Header Context (Strip newlines)
+$safeHeader = str_replace(["\r", "\n"], '', $input);
+header("X-Custom-Data: " . $safeHeader);
+
+// 5. Shell Argument Context (If using exec/system)
+$safeArg = escapeshellarg($input);
+system("echo " . $safeArg);
+```
+
+**Context Selection Guide:**
+
+| Context | Recommended PHP Function | Why? |
+|---------|--------------------------|------|
+| **HTML Content** | `htmlspecialchars(..., ENT_QUOTES)` | Converts `< > & " '` to entities. |
+| **JS Variable** | `json_encode()` | Safely wraps strings in quotes and escapes internal quotes/slashes. |
+| **URL Parameter** | `urlencode()` | Converts special chars to `%XX` format. |
+| **HTTP Header** | `str_replace(["\r", "\n"], '', $input)` | Prevents CRLF injection (Splitting). |
+| **Shell Command** | `escapeshellarg()` | Adds quotes and escapes shells meta-characters. |
+
+**Tools:** PHPStan, Psalm, SonarQube, Manual Security Review

package/skill-assets/sunlint-code-quality/rules/php/S023-dynamic-js-encoding.md

@@ -0,0 +1,62 @@
+---
+title: Output Encoding For Dynamic JS/JSON
+impact: HIGH
+impactDescription: prevents code injection when embedding server-side data into JavaScript
+tags: xss, javascript, json, encoding, security, php
+---
+
+## Output Encoding For Dynamic JS/JSON
+
+Embedding PHP data directly into JavaScript tags requires proper encoding to prevent Cross-Site Scripting (XSS). Simple string interpolation or manual quoting is dangerous. The safest way to pass complex data (strings, arrays, objects) from PHP to JavaScript is using `json_encode`.
+
+**Incorrect (unescaped data in inline Script):**
+
+```php
+// VULNERABLE: Direct interpolation in JS
+$username = "</script><script>alert('XSS')</script>";
+?>
+<script>
+    var current_user = "<?php echo $username; ?>"; 
+</script>
+<?php
+// Result: var current_user = "</script><script>alert('XSS')</script>"; 
+// The browser closes the first script tag and executes the second one!
+```
+
+**Correct (using json_encode):**
+
+```php
+$userData = [
+    'name' => $user->name,
+    'email' => $user->email,
+    'roles' => $user->getRoles()
+];
+
+// 1. Safe JSON encoding for inline script
+?>
+<script>
+    // json_encode automatically adds quotes and escapes dangerous characters
+    var appConfig = <?php echo json_encode($userData, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT); ?>;
+</script>
+
+<?php
+// 2. Best Practice: Using data attributes (Recommended for SPAs/Vue/React)
+?>
+<div id="user-profile" data-user="<?php echo htmlspecialchars(json_encode($userData), ENT_QUOTES, 'UTF-8'); ?>">
+    <!-- JS will read this via element.dataset.user -->
+</div>
+
+<?php
+// 3. In Laravel Blade
+?>
+<script>
+    var user = @json($userData);
+</script>
+```
+
+**Why `json_encode`?**
+- It handles strings, integers, booleans, and nested arrays/objects correctly for JavaScript.
+- It escapes backslashes and quotes automatically.
+- Using flags like `JSON_HEX_TAG` prevents `</script>` tags from breaking your own script block.
+
+**Tools:** Laravel Blade `@json` directive, SonarQube, Manual Security Review