public function f($str, $mode = 'escape') {
    switch($mode) {
      case 'strip':
        /* HTML tags are stripped from the string
           before it is used. */
        return strip_tags($str);
      case 'escapeAll':
        /* HTML and special characters are escaped from the string
           before it is used. */
        return htmlentities($str, ENT_QUOTES, $this->$_charset);
      case 'escape':
        /* Only HTML tags are escaped from the string. Special characters
           is kept as is. */
        return htmlspecialchars($str, ENT_NOQUOTES, $this->_charset);
      case 'url':
        /* Encode a string according to RFC 3986 for use in a URL. */
        return rawurlencode($str);
      case 'filename':
        /* Escape a string so it's safe to be used as filename. */
        return str_replace('/', '_', $str);
      default:
        throw new \phpSec\Exception\InvalidArgumentException('Unknown variable type');
    }
  }
public function f($str, $mode = 'escape') {
    switch($mode) {
      case 'strip':
        /* HTML tags are stripped from the string
           before it is used. */
        return strip_tags($str);
      case 'escapeAll':
        /* HTML and special characters are escaped from the string
           before it is used. */
        return htmlentities($str, ENT_QUOTES, $this->$_charset);
      case 'escape':
        /* Only HTML tags are escaped from the string. Special characters
           is kept as is. */
        return htmlspecialchars($str, ENT_NOQUOTES, $this->_charset);
      case 'url':
        /* Encode a string according to RFC 3986 for use in a URL. */
        return rawurlencode($str);
      case 'filename':
        /* Escape a string so it's safe to be used as filename. */
        return str_replace('/', '_', $str);
      default:
        throw new \phpSec\Exception\InvalidArgumentException('Unknown variable type');
    }
  }
public function f ( $ str , $ mode = 'escape' ) { switch ( $ mode ) { case 'strip' : /* HTML tags are stripped from the string
           before it is used. */ return strip_tags ( $ str ) ; case 'escapeAll' : /* HTML and special characters are escaped from the string
           before it is used. */ return htmlentities ( $ str , ENT_QUOTES , $ this -> $ _charset ) ; case 'escape' : /* Only HTML tags are escaped from the string. Special characters
           is kept as is. */ return htmlspecialchars ( $ str , ENT_NOQUOTES , $ this -> _charset ) ; case 'url' : /* Encode a string according to RFC 3986 for use in a URL. */ return rawurlencode ( $ str ) ; case 'filename' : /* Escape a string so it's safe to be used as filename. */ return str_replace ( '/' , '_' , $ str ) ; default : throw new \ phpSec \ Exception \ InvalidArgumentException ( 'Unknown variable type' ) ; } }
XSS filter. Returns a string that is safe to use on the page.

There are three modes:
strip: HTML is stripped from the string
before it is inserted.
escapeAll: HTML and special characters is escaped from the string
before it is inserted.
escape: Only HTML is escaped from the string. Special characters
is kept as is.
url: Encode a string according to RFC 3986 for use in a URL.
filename: Escape a string so it's safe to be used as filename.

@see https://phpseclib.com/manual/filter
@see http://www.faqs.org/rfcs/rfc3986

@param string $str
String to filter

@param string $mode
String defining what filter to apply.
XSS filter . Returns a string that is safe to use on the page .