From 0da4773ab62bef202ae62b3dcfa5809a69192837 Mon Sep 17 00:00:00 2001
From: Olayiwolaaa <muizzkara91@gmail.com>
Date: Wed, 17 Jun 2026 05:35:14 +0100
Subject: [PATCH 1/4] fix(security): escape JS string interpolation in
 initialize() to prevent XSS

---
 src/Flutterwave.php | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/src/Flutterwave.php b/src/Flutterwave.php
index b62ce7fc..0c307392 100644
--- a/src/Flutterwave.php
+++ b/src/Flutterwave.php
@@ -345,29 +345,29 @@ public function initialize(): void
         echo '<script>';
         echo 'document.addEventListener("DOMContentLoaded", function(event) {';
         echo 'FlutterwaveCheckout({
-            public_key: "' . self::$config->getPublicKey() . '",
-            tx_ref: "' . $this->txref . '",
-            amount: ' . $this->amount . ',
-            currency: "' . $this->currency . '",
-            country: "' . $this->country . '",
+            public_key: "' . addslashes(self::$config->getPublicKey()) . '",
+            tx_ref: "' . addslashes($this->txref) . '",
+            amount: ' . (float) $this->amount . ',
+            currency: "' . addslashes($this->currency) . '",
+            country: "' . addslashes($this->country) . '",
             payment_options: "card,ussd,mpesa,barter,mobilemoneyghana,
             mobilemoneyrwanda,mobilemoneyzambia,mobilemoneyuganda,banktransfer,account",
-            redirect_url:"' . $this->redirectUrl . '",
+            redirect_url:"' . addslashes($this->redirectUrl) . '",
             customer: {
-              email: "' . $this->customerEmail . '",
-              phone_number: "' . $this->customerPhone . '",
-              name: "' . $this->customerFirstname . ' ' . $this->customerLastname . '",
+              email: "' . addslashes($this->customerEmail) . '",
+              phone_number: "' . addslashes($this->customerPhone) . '",
+              name: "' . addslashes($this->customerFirstname) . ' ' . addslashes($this->customerLastname) . '",
             },
             callback: function (data) {
               console.log(data);
             },
             onclose: function() {
-                window.location = "?cancelled=cancelled&cancel_ref=' . $this->txref . '";
+                window.location = "?cancelled=cancelled&cancel_ref=' . addslashes($this->txref) . '";
               },
             customizations: {
-              title: "' . $this->customTitle . '",
-              description: "' . $this->customDescription . '",
-              logo: "' . $this->customLogo . '",
+              title: "' . addslashes($this->customTitle) . '",
+              description: "' . addslashes($this->customDescription) . '",
+              logo: "' . addslashes($this->customLogo) . '",
             }
         });';
         echo '});';

From ccb4d23a890a10c19b0bf110d4a6c2e8d86801df Mon Sep 17 00:00:00 2001
From: Olayiwolaaa <muizzkara91@gmail.com>
Date: Wed, 17 Jun 2026 07:26:49 +0100
Subject: [PATCH 2/4] refactor(security): replace string interpolation with
 json_encode in initialize()

---
 examples/endpoint/test-initialize.php  | 47 ++++++++++++
 src/Flutterwave.php                    | 56 ++++++++-------
 tests/Unit/Checkout/InitializeTest.php | 98 ++++++++++++++++++++++++++
 3 files changed, 174 insertions(+), 27 deletions(-)
 create mode 100644 examples/endpoint/test-initialize.php
 create mode 100644 tests/Unit/Checkout/InitializeTest.php

diff --git a/examples/endpoint/test-initialize.php b/examples/endpoint/test-initialize.php
new file mode 100644
index 00000000..3ac3ae5c
--- /dev/null
+++ b/examples/endpoint/test-initialize.php
@@ -0,0 +1,47 @@
+<?php
+require __DIR__."/../../vendor/autoload.php";
+
+session_start();
+
+\Flutterwave\Flutterwave::bootstrap();
+
+try {
+    $flw = new \Flutterwave\Flutterwave();
+    $flw->setAmount('1000')
+        ->setCurrency(\Flutterwave\Util\Currency::NGN)
+        ->setCountry('NG')
+        ->setEmail('test@example.com')
+        ->setFirstname('John')
+        ->setLastname('Doe')
+        ->setPhoneNumber('+2349067985861')
+        ->setRedirectUrl("http://{$_SERVER['HTTP_HOST']}/examples/endpoint/verify.php")
+        ->setTitle('Test Payment') # ->setTitle('</script><script>alert(1)</script>') change title to this for testing XSS fix
+        ->setDescription('Testing initialize XSS fix')
+        ->setLogo('https://mysite.com/logo.png')
+        ->setPaymentOptions('card,banktransfer');
+
+    if (!empty($_REQUEST) && isset($_REQUEST['make'])) {
+        $flw->initialize(); // this renders the full modal page
+        exit;
+    }
+
+} catch (Exception $e) {
+    $error = $e->getMessage();
+}
+?>
+
+<link rel="stylesheet" href="../assets/css/index.css">
+<div class="buttons">
+    <form method="get">
+        <h3>Initialize() XSS Fix - Smoke Test</h3>
+        <span class="error"><?= $error ?? "" ?></span>
+        <div class="cta">
+            <button class="make-payment" name="make" value="1">Test Initialize</button>
+        </div>
+    </form>
+</div>
+
+<script src="https://code.jquery.com/jquery-3.4.1.slim.min.js"
+        integrity="sha384-J6qa4849blE2+poT4WnyKhv5vZF5SrPo0iEjwBvKU7imGFAV0wwj1yYfoRSJoZ+n"
+        crossorigin="anonymous"></script>
+<script src="../assets/js/index.js"></script>
\ No newline at end of file
diff --git a/src/Flutterwave.php b/src/Flutterwave.php
index 0c307392..855e0dcc 100644
--- a/src/Flutterwave.php
+++ b/src/Flutterwave.php
@@ -334,42 +334,44 @@ public function initialize(): void
 
         $this->logger->info('Rendering Payment Modal..');
 
+        $checkoutConfig = json_encode([
+            'public_key'                    => self::$config->getPublicKey(),
+            'tx_ref'            => $this->txref,
+            'amount'            => (float) $this->amount,
+            'currency'          => $this->currency,
+            'country'           => $this->country,
+            'payment_options'   => $this->paymentOptions,
+            'redirect_url'      => $this->redirectUrl,
+            'customer'          => [
+                'email'         => $this->customerEmail,
+                'phone_number'  => $this->customerPhone,
+                'name'          => $this->customerFirstname . ' ' . $this->customerLastname,
+            ],
+            'customizations'    => [
+                'title'         => $this->customTitle,
+                'description'   => $this->customDescription,
+                'logo'          => $this->customLogo,
+            ],
+        ], JSON_HEX_TAG | JSON_HEX_QUOT | JSON_THROW_ON_ERROR);
+
+        echo '<!DOCTYPE html>';
         echo '<html lang="en">';
+        echo '<head><meta charset="UTF-8"></head>';
         echo '<body>';
         //        $loader_img_src = FLW_PHP_ASSET_DIR."js/v3.js";
         echo '<div style="display: flex; flex-direction: row;justify-content: center; align-content: center ">
-        Proccessing...<img src="../assets/images/ajax-loader.gif"  alt="loading-gif"/></div>';
+        Processing...<img src="../assets/images/ajax-loader.gif"  alt="loading-gif"/></div>';
         //        $script_src = FLW_PHP_ASSET_DIR."js/v3.js";
         echo '<script type="text/javascript" src="https://checkout.flutterwave.com/v3.js"></script>';
 
         echo '<script>';
         echo 'document.addEventListener("DOMContentLoaded", function(event) {';
-        echo 'FlutterwaveCheckout({
-            public_key: "' . addslashes(self::$config->getPublicKey()) . '",
-            tx_ref: "' . addslashes($this->txref) . '",
-            amount: ' . (float) $this->amount . ',
-            currency: "' . addslashes($this->currency) . '",
-            country: "' . addslashes($this->country) . '",
-            payment_options: "card,ussd,mpesa,barter,mobilemoneyghana,
-            mobilemoneyrwanda,mobilemoneyzambia,mobilemoneyuganda,banktransfer,account",
-            redirect_url:"' . addslashes($this->redirectUrl) . '",
-            customer: {
-              email: "' . addslashes($this->customerEmail) . '",
-              phone_number: "' . addslashes($this->customerPhone) . '",
-              name: "' . addslashes($this->customerFirstname) . ' ' . addslashes($this->customerLastname) . '",
-            },
-            callback: function (data) {
-              console.log(data);
-            },
-            onclose: function() {
-                window.location = "?cancelled=cancelled&cancel_ref=' . addslashes($this->txref) . '";
-              },
-            customizations: {
-              title: "' . addslashes($this->customTitle) . '",
-              description: "' . addslashes($this->customDescription) . '",
-              logo: "' . addslashes($this->customLogo) . '",
-            }
-        });';
+        echo '  var config = ' . $checkoutConfig . ';';
+        echo '  config.callback = function(data) { console.log(data); };';
+        echo '  config.onclose = function() {';
+        echo '    window.location = "?cancelled=cancelled&cancel_ref=' . urlencode($this->txref) . '";';
+        echo '  };';
+        echo '  FlutterwaveCheckout(config);';
         echo '});';
         echo '</script>';
         echo '</body>';
diff --git a/tests/Unit/Checkout/InitializeTest.php b/tests/Unit/Checkout/InitializeTest.php
new file mode 100644
index 00000000..9f991f95
--- /dev/null
+++ b/tests/Unit/Checkout/InitializeTest.php
@@ -0,0 +1,98 @@
+<?php
+
+namespace Unit\Checkout;
+
+use PHPUnit\Framework\TestCase;
+use Flutterwave\Flutterwave;
+use Flutterwave\Test\Resources\Setup\Config;
+
+class InitializeTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        Flutterwave::bootstrap();
+    }
+
+    private function buildInstance(): Flutterwave
+    {
+        $instance = new Flutterwave();
+        $instance
+            ->setAmount('1000')
+            ->setCurrency('NGN')
+            ->setCountry('NG')
+            ->setEmail('test@example.com')
+            ->setFirstname('John')
+            ->setLastname('Doe')
+            ->setPhoneNumber('+2349012345678')
+            ->setRedirectUrl('https://mysite.com/callback')
+            ->setTitle('Test Payment')
+            ->setDescription('Test Description')
+            ->setLogo('https://mysite.com/logo.png')
+            ->setPaymentOptions('card,banktransfer');
+
+        return $instance;
+    }
+
+    public function testInitializeEscapesScriptTagInTitle(): void
+    {
+        $instance = $this->buildInstance();
+        $instance->setTitle('</script><script>alert(1)</script>');
+
+        ob_start();
+        $instance->initialize();
+        $output = ob_get_clean();
+
+        $this->assertStringNotContainsString('</script><script>', $output);
+        $this->assertStringContainsString('\u003C', $output); // JSON_HEX_TAG encoding of 
+    }
+
+    public function testInitializeEscapesQuotesInCustomerName(): void
+    {
+        $instance = $this->buildInstance();
+        $instance->setFirstname("O'Brien");
+        $instance->setLastname('"Hacker"');
+
+        ob_start();
+        $instance->initialize();
+        $output = ob_get_clean();
+
+        $this->assertStringNotContainsString('"Hacker"', $output);
+        $this->assertStringNotContainsString("'Brien", $output);
+    }
+
+    public function testInitializeEscapesRedirectUrl(): void
+    {
+        $instance = $this->buildInstance();
+        $instance->setRedirectUrl('https://evil.com","public_key":"leaked');
+
+        ob_start();
+        $instance->initialize();
+        $output = ob_get_clean();
+
+        $this->assertStringNotContainsString('"public_key":"leaked', $output);
+    }
+
+    public function testInitializeCastsAmountToFloat(): void
+    {
+        $instance = $this->buildInstance();
+        $instance->setAmount('100');
+
+        ob_start();
+        $instance->initialize();
+        $output = ob_get_clean();
+
+        $this->assertStringContainsString('"amount":100.0', $output);
+    }
+
+    public function testInitializeUsesSetPaymentOptions(): void
+    {
+        $instance = $this->buildInstance();
+        $instance->setPaymentOptions('card,banktransfer');
+
+        ob_start();
+        $instance->initialize();
+        $output = ob_get_clean();
+
+        $this->assertStringContainsString('"payment_options":"card,banktransfer"', $output);
+    }
+}
\ No newline at end of file

From 6fd98cae48253d1eab6a15bd600282cb43bc963b Mon Sep 17 00:00:00 2001
From: Olayiwolaaa <muizzkara91@gmail.com>
Date: Wed, 17 Jun 2026 12:38:19 +0100
Subject: [PATCH 3/4] fix(security): move XSS fix to Modal::getHtml() and
 deprecate initialize()

---
 src/Flutterwave.php   | 113 +++++++++++++++++++++++-------------------
 src/Library/Modal.php |  49 +++++++++---------
 2 files changed, 87 insertions(+), 75 deletions(-)

diff --git a/src/Flutterwave.php b/src/Flutterwave.php
index 855e0dcc..0cf7fe9c 100644
--- a/src/Flutterwave.php
+++ b/src/Flutterwave.php
@@ -321,62 +321,71 @@ public function requeryTransaction(string $referenceNumber): object
     }
 
     /**
-     * Generates the final json to be used in configuring the payment call to the rave payment gateway
+     * @deprecated Use render('inline')->getHtml() instead.
+     * Will be removed in a future version.
      */
     public function initialize(): void
     {
-        $this->createCheckSum();
-
-        $appId = $this->signoz->getAppId();
-        $environment = $this->signoz->getCurrentEnvironment();
+        // $this->createCheckSum();
+
+        // $appId = $this->signoz->getAppId();
+        // $environment = $this->signoz->getCurrentEnvironment();
+
+        // $this->signoz->trackRequestSent($appId, $environment, 'GET', $this->txref, '/inline');
+
+        // $this->logger->info('Rendering Payment Modal..');
+
+        // $checkoutConfig = json_encode([
+        //     'public_key'                    => self::$config->getPublicKey(),
+        //     'tx_ref'            => $this->txref,
+        //     'amount'            => (float) $this->amount,
+        //     'currency'          => $this->currency,
+        //     'country'           => $this->country,
+        //     'payment_options'   => $this->paymentOptions,
+        //     'redirect_url'      => $this->redirectUrl,
+        //     'customer'          => [
+        //         'email'         => $this->customerEmail,
+        //         'phone_number'  => $this->customerPhone,
+        //         'name'          => $this->customerFirstname . ' ' . $this->customerLastname,
+        //     ],
+        //     'customizations'    => [
+        //         'title'         => $this->customTitle,
+        //         'description'   => $this->customDescription,
+        //         'logo'          => $this->customLogo,
+        //     ],
+        // ], JSON_HEX_TAG | JSON_HEX_QUOT | JSON_THROW_ON_ERROR);
+
+        // echo '<!DOCTYPE html>';
+        // echo '<html lang="en">';
+        // echo '<head><meta charset="UTF-8"></head>';
+        // echo '<body>';
+        // //        $loader_img_src = FLW_PHP_ASSET_DIR."js/v3.js";
+        // echo '<div style="display: flex; flex-direction: row;justify-content: center; align-content: center ">
+        // Processing...<img src="../assets/images/ajax-loader.gif"  alt="loading-gif"/></div>';
+        // //        $script_src = FLW_PHP_ASSET_DIR."js/v3.js";
+        // echo '<script type="text/javascript" src="https://checkout.flutterwave.com/v3.js"></script>';
+
+        // echo '<script>';
+        // echo 'document.addEventListener("DOMContentLoaded", function(event) {';
+        // echo '  var config = ' . $checkoutConfig . ';';
+        // echo '  config.callback = function(data) { console.log(data); };';
+        // echo '  config.onclose = function() {';
+        // echo '    window.location = "?cancelled=cancelled&cancel_ref=' . urlencode($this->txref) . '";';
+        // echo '  };';
+        // echo '  FlutterwaveCheckout(config);';
+        // echo '});';
+        // echo '</script>';
+        // echo '</body>';
+        // echo '</html>';
+        // $this->logger->info('Rendered Payment Modal Successfully..');
+
+        @trigger_error(
+            'initialize() is deprecated and will be removed in a future version. Use render(\'inline\')->with([...])->getHtml() instead.',
+            E_USER_DEPRECATED
+        );
 
-        $this->signoz->trackRequestSent($appId, $environment, 'GET', $this->txref, '/inline');
-
-        $this->logger->info('Rendering Payment Modal..');
-
-        $checkoutConfig = json_encode([
-            'public_key'                    => self::$config->getPublicKey(),
-            'tx_ref'            => $this->txref,
-            'amount'            => (float) $this->amount,
-            'currency'          => $this->currency,
-            'country'           => $this->country,
-            'payment_options'   => $this->paymentOptions,
-            'redirect_url'      => $this->redirectUrl,
-            'customer'          => [
-                'email'         => $this->customerEmail,
-                'phone_number'  => $this->customerPhone,
-                'name'          => $this->customerFirstname . ' ' . $this->customerLastname,
-            ],
-            'customizations'    => [
-                'title'         => $this->customTitle,
-                'description'   => $this->customDescription,
-                'logo'          => $this->customLogo,
-            ],
-        ], JSON_HEX_TAG | JSON_HEX_QUOT | JSON_THROW_ON_ERROR);
-
-        echo '<!DOCTYPE html>';
-        echo '<html lang="en">';
-        echo '<head><meta charset="UTF-8"></head>';
-        echo '<body>';
-        //        $loader_img_src = FLW_PHP_ASSET_DIR."js/v3.js";
-        echo '<div style="display: flex; flex-direction: row;justify-content: center; align-content: center ">
-        Processing...<img src="../assets/images/ajax-loader.gif"  alt="loading-gif"/></div>';
-        //        $script_src = FLW_PHP_ASSET_DIR."js/v3.js";
-        echo '<script type="text/javascript" src="https://checkout.flutterwave.com/v3.js"></script>';
-
-        echo '<script>';
-        echo 'document.addEventListener("DOMContentLoaded", function(event) {';
-        echo '  var config = ' . $checkoutConfig . ';';
-        echo '  config.callback = function(data) { console.log(data); };';
-        echo '  config.onclose = function() {';
-        echo '    window.location = "?cancelled=cancelled&cancel_ref=' . urlencode($this->txref) . '";';
-        echo '  };';
-        echo '  FlutterwaveCheckout(config);';
-        echo '});';
-        echo '</script>';
-        echo '</body>';
-        echo '</html>';
-        $this->logger->info('Rendered Payment Modal Successfully..');
+        $this->createCheckSum();
+        echo $this->render(Modal::POPUP)->getHtml();
     }
 
     /**
diff --git a/src/Library/Modal.php b/src/Library/Modal.php
index bd90d16c..69a3a9bb 100644
--- a/src/Library/Modal.php
+++ b/src/Library/Modal.php
@@ -121,36 +121,39 @@ public function getHtml()
         $payment_method = $payload['payment_method'] ?? $default_options;
 
         $this->logger->info('Rendering Payment Modal..');
+
+        $checkoutConfig = json_encode([
+            'public_key'        => self::$config->getPublicKey(),
+            'tx_ref'            => $payload['tx_ref'],
+            'amount'            => $payload['amount'],
+            'currency'          => $currency,
+            'country'           => $country,
+            'payment_options'   => $payment_method,
+            'redirect_url'      => $payload['redirect_url'],
+            'payload_hash'      => $payload['payload_hash'],
+            'customer'          => [
+                'email'         => $payload['email'],
+                'phone_number'  => $payload['phone_number'],
+                'name'          => $payload['fullname']
+            ]
+        ], JSON_HEX_TAG | JSON_HEX_QUOT | JSON_THROW_ON_ERROR);
+
         $html = '';
 
+        $html .= '<!DOCTYPE html>';
         $html .= '<html lang="en">';
         $html .= '<body>';
         $html .= '<div style="display: flex; flex-direction: row;justify-content: center; align-content: center ">
-        Proccessing...<img src="../assets/images/ajax-loader.gif"  alt="loading-gif"/></div>';
+        Processing...<img src="../assets/images/ajax-loader.gif"  alt="loading-gif"/></div>';
         $html .= '<script type="text/javascript" src="https://checkout.flutterwave.com/v3.js"></script>';
         $html .= '<script>';
-        $html .= 'document.addEventListener("DOMContentLoaded", function(event) {';
-        $html .= 'FlutterwaveCheckout({
-            public_key: "' . self::$config->getPublicKey() . '",
-            tx_ref: "' . $payload['tx_ref'] . '",
-            amount: ' . $payload['amount'] . ',
-            currency: "' . $currency . '",
-            country: "' . $country . '",
-            payment_options: "' . $payment_method . '",
-            redirect_url:"' . $payload['redirect_url'] . '",
-            payload_hash:"' . $payload['payload_hash'] . '",
-            customer: {
-              email: "' . $payload['email'] . '",
-              phone_number: "' . $payload['phone_number'] . '",
-              name: "' . $payload['fullname'] . '",
-            },
-            callback: function (data) {
-              console.log(data);
-            },
-            onclose: function() {
-                window.location = "?status=cancelled&tx_ref=' . $payload['tx_ref'] . '";
-            }
-        });';
+        $html .= 'document.addEventListener("DOMContentLoaded", function() {';
+        $html .= '  var config = ' . $checkoutConfig . ';';
+        $html .= '  config.callback = function(data) { console.log(data); };';
+        $html .= '  config.onclose = function() {';
+        $html .= '    window.location = "?status=cancelled&tx_ref=' . urlencode($payload['tx_ref']) . '";';
+        $html .= '  };';
+        $html .= '  FlutterwaveCheckout(config);';
         $html .= '});';
         $html .= '</script>';
         $html .= '</body>';

From e5bf210fee1282c67d467676cafeffe3718c7b81 Mon Sep 17 00:00:00 2001
From: Olayiwolaaa <muizzkara91@gmail.com>
Date: Wed, 17 Jun 2026 20:27:43 +0100
Subject: [PATCH 4/4] fix: align initialize() payload with Modal::with()
 expected keys

- Move customer fields (email, phone_number, first_name, last_name) to
  top level in checkout config to match Modal::with() contract
- Add payment_method key alongside payment_options
- Pass customizations through to Modal via payload setters
- Add JSON_HEX_APOS and JSON_PRESERVE_ZERO_FRACTION flags to
  json_encode in Modal::getHtml() for proper escaping and float output
- Fix testInitializeEscapesScriptTagInTitle to not match legitimate
  HTML template script tags
- Rewrite testInitializeIsDeprecated to use set_error_handler since
  @trigger_error suppresses PHPUnit deprecation conversion
---
 src/Flutterwave.php                    | 77 ++++++++------------------
 src/Library/Modal.php                  | 22 ++++++--
 tests/Unit/Checkout/InitializeTest.php | 38 ++++++++++---
 3 files changed, 68 insertions(+), 69 deletions(-)

diff --git a/src/Flutterwave.php b/src/Flutterwave.php
index 0cf7fe9c..65a2a401 100644
--- a/src/Flutterwave.php
+++ b/src/Flutterwave.php
@@ -326,66 +326,33 @@ public function requeryTransaction(string $referenceNumber): object
      */
     public function initialize(): void
     {
-        // $this->createCheckSum();
-
-        // $appId = $this->signoz->getAppId();
-        // $environment = $this->signoz->getCurrentEnvironment();
-
-        // $this->signoz->trackRequestSent($appId, $environment, 'GET', $this->txref, '/inline');
-
-        // $this->logger->info('Rendering Payment Modal..');
-
-        // $checkoutConfig = json_encode([
-        //     'public_key'                    => self::$config->getPublicKey(),
-        //     'tx_ref'            => $this->txref,
-        //     'amount'            => (float) $this->amount,
-        //     'currency'          => $this->currency,
-        //     'country'           => $this->country,
-        //     'payment_options'   => $this->paymentOptions,
-        //     'redirect_url'      => $this->redirectUrl,
-        //     'customer'          => [
-        //         'email'         => $this->customerEmail,
-        //         'phone_number'  => $this->customerPhone,
-        //         'name'          => $this->customerFirstname . ' ' . $this->customerLastname,
-        //     ],
-        //     'customizations'    => [
-        //         'title'         => $this->customTitle,
-        //         'description'   => $this->customDescription,
-        //         'logo'          => $this->customLogo,
-        //     ],
-        // ], JSON_HEX_TAG | JSON_HEX_QUOT | JSON_THROW_ON_ERROR);
-
-        // echo '<!DOCTYPE html>';
-        // echo '<html lang="en">';
-        // echo '<head><meta charset="UTF-8"></head>';
-        // echo '<body>';
-        // //        $loader_img_src = FLW_PHP_ASSET_DIR."js/v3.js";
-        // echo '<div style="display: flex; flex-direction: row;justify-content: center; align-content: center ">
-        // Processing...<img src="../assets/images/ajax-loader.gif"  alt="loading-gif"/></div>';
-        // //        $script_src = FLW_PHP_ASSET_DIR."js/v3.js";
-        // echo '<script type="text/javascript" src="https://checkout.flutterwave.com/v3.js"></script>';
-
-        // echo '<script>';
-        // echo 'document.addEventListener("DOMContentLoaded", function(event) {';
-        // echo '  var config = ' . $checkoutConfig . ';';
-        // echo '  config.callback = function(data) { console.log(data); };';
-        // echo '  config.onclose = function() {';
-        // echo '    window.location = "?cancelled=cancelled&cancel_ref=' . urlencode($this->txref) . '";';
-        // echo '  };';
-        // echo '  FlutterwaveCheckout(config);';
-        // echo '});';
-        // echo '</script>';
-        // echo '</body>';
-        // echo '</html>';
-        // $this->logger->info('Rendered Payment Modal Successfully..');
-
         @trigger_error(
             'initialize() is deprecated and will be removed in a future version. Use render(\'inline\')->with([...])->getHtml() instead.',
             E_USER_DEPRECATED
         );
-
+        
         $this->createCheckSum();
-        echo $this->render(Modal::POPUP)->getHtml();
+
+        $checkoutConfig = [
+            'public_key'        => self::$config->getPublicKey(),
+            'tx_ref'            => $this->txref,
+            'amount'            => (float) $this->amount,
+            'currency'          => $this->currency,
+            'country'           => $this->country,
+            'redirect_url'      => $this->redirectUrl,
+            'payment_method'    => $this->paymentOptions,
+            'email'             => $this->customerEmail,
+            'phone_number'      => $this->customerPhone,
+            'first_name'        => $this->customerFirstname,
+            'last_name'         => $this->customerLastname,
+            'customizations'    => [
+                'title'         => $this->customTitle,
+                'description'   => $this->customDescription,
+                'logo'          => $this->customLogo,
+            ],
+        ];
+
+        echo $this->render(Modal::POPUP)->with($checkoutConfig)->getHtml();
     }
 
     /**
diff --git a/src/Library/Modal.php b/src/Library/Modal.php
index 69a3a9bb..adb432b9 100644
--- a/src/Library/Modal.php
+++ b/src/Library/Modal.php
@@ -70,7 +70,7 @@ public function with(array $args)
         }
 
         $this->customer = (new \Flutterwave\Factories\CustomerFactory())->create($args['customer']);
-
+        
         $args['customer'] = $this->customer;
 
         if (isset($args['tx_ref'])) {
@@ -83,10 +83,15 @@ public function with(array $args)
         } else {
             $args = array_merge($args, $this->generatedTransactionData);
         }
-        $this->payload = (new \Flutterwave\Factories\PayloadFactory())->create($args);
 
+        $this->payload = (new \Flutterwave\Factories\PayloadFactory())->create($args);
+        
         $this->payload->set('redirect_url', $args['redirect_url']);
         $this->payload->set('payment_method', $args['payment_method']);
+        
+        $this->payload->set('custom_title', $args['customizations']['title'] ?? '');
+        $this->payload->set('custom_description', $args['customizations']['description'] ?? '');
+        $this->payload->set('custom_logo', $args['customizations']['logo'] ?? '');
 
         $dataToHash = [
             'amount' => $args['amount'],
@@ -135,9 +140,14 @@ public function getHtml()
                 'email'         => $payload['email'],
                 'phone_number'  => $payload['phone_number'],
                 'name'          => $payload['fullname']
-            ]
-        ], JSON_HEX_TAG | JSON_HEX_QUOT | JSON_THROW_ON_ERROR);
-
+            ],
+            'customizations'    => [
+                'title'         => $payload['custom_title'],
+                'description'   => $payload['custom_description'],
+                'logo'          => $payload['custom_logo'],
+            ],
+        ], JSON_HEX_TAG | JSON_PRESERVE_ZERO_FRACTION | JSON_HEX_QUOT | JSON_HEX_APOS | JSON_THROW_ON_ERROR);
+ 
         $html = '';
 
         $html .= '<!DOCTYPE html>';
@@ -147,7 +157,7 @@ public function getHtml()
         Processing...<img src="../assets/images/ajax-loader.gif"  alt="loading-gif"/></div>';
         $html .= '<script type="text/javascript" src="https://checkout.flutterwave.com/v3.js"></script>';
         $html .= '<script>';
-        $html .= 'document.addEventListener("DOMContentLoaded", function() {';
+        $html .= 'document.addEventListener("DOMContentLoaded", function(event) {';
         $html .= '  var config = ' . $checkoutConfig . ';';
         $html .= '  config.callback = function(data) { console.log(data); };';
         $html .= '  config.onclose = function() {';
diff --git a/tests/Unit/Checkout/InitializeTest.php b/tests/Unit/Checkout/InitializeTest.php
index 9f991f95..ac3e0159 100644
--- a/tests/Unit/Checkout/InitializeTest.php
+++ b/tests/Unit/Checkout/InitializeTest.php
@@ -4,7 +4,7 @@
 
 use PHPUnit\Framework\TestCase;
 use Flutterwave\Flutterwave;
-use Flutterwave\Test\Resources\Setup\Config;
+use Flutterwave\EventHandlers\ModalEventHandler;
 
 class InitializeTest extends TestCase
 {
@@ -17,16 +17,17 @@ private function buildInstance(): Flutterwave
     {
         $instance = new Flutterwave();
         $instance
+            ->eventHandler(new ModalEventHandler())
             ->setAmount('1000')
-            ->setCurrency('NGN')
+            ->setCurrency(\Flutterwave\Util\Currency::NGN)
             ->setCountry('NG')
             ->setEmail('test@example.com')
             ->setFirstname('John')
             ->setLastname('Doe')
-            ->setPhoneNumber('+2349012345678')
-            ->setRedirectUrl('https://mysite.com/callback')
+            ->setPhoneNumber('+2349067985861')
+            ->setRedirectUrl('https://example.com/callback')
             ->setTitle('Test Payment')
-            ->setDescription('Test Description')
+            ->setDescription('Testing initialize XSS fix')
             ->setLogo('https://mysite.com/logo.png')
             ->setPaymentOptions('card,banktransfer');
 
@@ -42,8 +43,8 @@ public function testInitializeEscapesScriptTagInTitle(): void
         $instance->initialize();
         $output = ob_get_clean();
 
-        $this->assertStringNotContainsString('</script><script>', $output);
-        $this->assertStringContainsString('\u003C', $output); // JSON_HEX_TAG encoding of 
+        $this->assertStringNotContainsString('<script>alert(1)</script>', $output);
+        $this->assertStringContainsString('\u003C', $output);
     }
 
     public function testInitializeEscapesQuotesInCustomerName(): void
@@ -93,6 +94,27 @@ public function testInitializeUsesSetPaymentOptions(): void
         $instance->initialize();
         $output = ob_get_clean();
 
-        $this->assertStringContainsString('"payment_options":"card,banktransfer"', $output);
+        $this->assertStringContainsString('card,banktransfer', $output);
+    }
+
+    public function testInitializeIsDeprecated(): void
+    {
+        $instance = $this->buildInstance();
+
+        $deprecationTriggered = false;
+        set_error_handler(function (int $errno, string $errstr) use (&$deprecationTriggered) {
+            if ($errno === E_USER_DEPRECATED && str_contains($errstr, 'initialize() is deprecated')) {
+                $deprecationTriggered = true;
+            }
+            return true;
+        });
+
+        ob_start();
+        $instance->initialize();
+        ob_get_clean();
+
+        restore_error_handler();
+
+        $this->assertTrue($deprecationTriggered, 'Expected a deprecation notice for initialize()');
     }
 }
\ No newline at end of file