Php defense against XSS and ajax cross-origin attacks

There are many ways to launch XSS attacks on websites. Some built-in filter functions in php alone cannot be used. Even if you use filter_var, mysql_real_escape_string, htmlentities, and htmlspecialchars, strip_tags functions are used and cannot guarantee absolute security.

Currently, many php development frameworks provide filtering methods against XSS attacks. The following is a function to prevent XSS attacks and ajax cross-origin attacks. This function is taken from a development framework, it should be better than just using built-in functions.

function xss_clean($data){// Fix &entity\n;$data=str_replace(array('&amp;','&lt;','&gt;'),array('&amp;amp;','&amp;lt;','&amp;gt;'),$data);$data=preg_replace('/(&#*\w+)[\x00-\x20]+;/u','$1;',$data);$data=preg_replace('/(&#x*[0-9A-F]+);*/iu','$1;',$data);$data=html_entity_decode($data,ENT_COMPAT,'UTF-8');// Remove any attribute starting with "on" or xmlns$data=preg_replace('#(<[^>]+?[\x00-\x20"\'])(?:on|xmlns)[^>]*+>#iu','$1>',$data);// Remove javascript: and vbscript: protocols$data=preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu','$1=$2nojavascript...',$data);$data=preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu','$1=$2novbscript...',$data);$data=preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u','$1=$2nomozbinding...',$data);// Only works in IE: <span style="width: expression(alert('Ping!'));"></span>$data=preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#i','$1>',$data);$data=preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#i','$1>',$data);$data=preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#iu','$1>',$data);// Remove namespaced elements (we do not need them)$data=preg_replace('#</*\w+:\w[^>]*+>#i','',$data);// http://www.phpernote.com/do{// Remove really unwanted tags$old_data=$data;$data=preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i','',$data);}while($old_data!==$data);// we are done...return $data;}

Articles you may be interested in

• Common PHP anti-injection vulnerability filtering function code
• Php extracts the birthday date from the ID card number and verifies whether it is a minor.
• PHP checks browser parameters to prevent SQL injection.
• Measures to prevent website attacks
• Jquery + html + php implement Ajax without refreshing File Upload
• Php judges the day of the month as the day of the week
• Php programmer interview questions-common basic questions and answers (1)
• Use php functions in the smarty template and how to use multiple functions for a variable in the smarty Template