Fix XSS in API Responses in Slim

XSS in APIs occurs when your Slim routes reflect unsanitized input directly into the response body. While often associated with HTML templates, APIs are vulnerable if they lack proper Content-Type headers or return raw data that a browser might 'sniff' and execute. If you're outputting raw strings or failing to enforce application/json, you're handing an execution vector to the attacker.

The Vulnerable Pattern

$app->get('/user/search', function ($request, $response) {
    $term = $request->getQueryParams()['q'] ?? '';
    // VULNERABLE: Direct reflection of input without encoding or strict Content-Type
    $response->getBody()->write("Results for: " . $term);
    return $response;
});

The Secure Implementation

The fix is twofold: Strict Output Encoding and Header Enforcement. In the vulnerable example, the browser may default to text/html, allowing // and runs json_encode() which escapes dangerous characters. return $response->withJson($data, 200);

});