I have TeX Live 2019 installed on my server and generate PDFs from a LaTeX-Template with a server-side scripting language (PHP 7). I have to insert data from the database (untrusted data) and also some data from the users (also untrusted data) into that template (dynamic LaTeX document) and then compile it to PDF. This data is used in tables, captions, and texts, etc. I cannot use a blacklist/whitelist approach for characters, because users should be able to use all of them.
How can I escape that untrusted data in such a way so all UTF-8 characters and also characters that have special meaning in LaTeX would still work (ä,ö,ü,á,ß,°,\,%,`...) ? Is there something similar to PDO for LaTeX? I'm familar with verbatim
package, but from by experience it doesn't guarantee for 100% that one could not bypass such protection ("Defenses against attacks" in the paper).
Here is a list of character replacement that i came up with (incomplete):
You can probaly already imagine that there is problem with replacing characters - because it should be done in the right order and needs to be done very carefully so one would not be able to bypass it.
LaTeX-Injection articles:
p
mode for TeX Live