How PHP prevents utf-7 from reflecting XSS vulnerabilities.

Using the yii1.1 framework

        $req = Yii::app()->request;        $purifier = new CHtmlPurifier();        $purifier->options = array(            'URI.AllowedSchemes'=>array(                'http' => true,                'https' => true,            )        );            $url = $purifier->purify($req->getParam('url'));

All the parameters are filtered using purify. But there is still this loophole. How to solve. Is there a better plan for liberation?

Reply content:

Using the yii1.1 framework

        $req = Yii::app()->request;        $purifier = new CHtmlPurifier();        $purifier->options = array(            'URI.AllowedSchemes'=>array(                'http' => true,                'https' => true,            )        );            $url = $purifier->purify($req->getParam('url'));

All the parameters are filtered using purify. But there is still this loophole. How to solve. Is there a better plan for liberation?

1 Custom methods Filter Common XSS attacks tags: script|iframe|image/uis
2 Configuration Direction considerations: Setting HttpOnly to Disallow cookie access
3 Service Direction: Use SSL protocol, prohibit loading external JS

