---
title: "Deprecation: #76164 - Deprecate RemoveXSS"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:deprecation-76164"
source: "Changelog/8.2/Deprecation-76164-DeprecateRemoveXSS.rst"
typo3-version: "8.2"
typo3-major: 8
type: "deprecation"
issue: 76164
forge: "https://forge.typo3.org/issues/76164"
tags: ["PHP-API"]
rendered: "2026-09-17T21:17:42+00:00"
---

# Deprecation: #76164 - Deprecate RemoveXSS {#deprecation-76164-deprecate-removexss}

See [forge#76164](https://forge.typo3.org/issues/76164)

## Description {#description}

Due to the wrong approach of RemoveXSS it is not 100% secure and does not keep its
promise. The following methods have been marked as deprecated:

-   `\TYPO3\CMS\Core\Utility\GeneralUtility::removeXSS()`
-   `\RemoveXSS::process()`
-   `\TYPO3\CMS\Form\Domain\Filter\RemoveXssFilter`

## Impact {#impact}

Using the mentioned methods will trigger a deprecation log entry.

## Affected Installations {#affected-installations}

Instances that use any of these methods.

## Migration {#migration}

Implement a proper encoding by yourself. Use `htmlspecialchars()` in the
context of HTML or `GeneralUtility::quoteJSvalue()` in the context of JavaScript.