Php prevents XSS attacks and ajax cross-origin attacks. There are many ways to launch XSS attacks on websites. some built-in filter functions in php alone cannot be used. even if you use filter_var, mysql_real_escape_string, htmlentities, htmlspec can launch XSS attacks on websites in many ways. some built-in filter functions in php alone cannot be used. even if you use filter_var, mysql_real_escape_string, htmlentities, and htmlspecialchars, strip_tags functions are used and cannot guarantee absolute security.
Currently, many php development frameworks provide filtering methods against XSS attacks. The following is a function to prevent XSS attacks and ajax cross-origin attacks. This function is taken from a development framework, it should be better than just using built-in functions.
function xss_clean($data){// Fix &entity\n;$data=str_replace(array('&','<','>'),array('&','<','>'),$data);$data=preg_replace('/(&#*\w+)[\x00-\x20]+;/u','$1;',$data);$data=preg_replace('/(&#x*[0-9A-F]+);*/iu','$1;',$data);$data=html_entity_decode($data,ENT_COMPAT,'UTF-8');// Remove any attribute starting with "on" or xmlns$data=preg_replace('#(<[^>]+?[\x00-\x20"\'])(?:on|xmlns)[^>]*+>#iu','$1>',$data);// Remove javascript: and vbscript: protocols$data=preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu','$1=$2nojavascript...',$data);$data=preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu','$1=$2novbscript...',$data);$data=preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u','$1=$2nomozbinding...',$data);// Only works in IE: $data=preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#i','$1>',$data);$data=preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#i','$1>',$data);$data=preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#iu','$1>',$data);// Remove namespaced elements (we do not need them)$data=preg_replace('#
]*+>#i','',$data);// http://www.phpernote.com/do{// Remove really unwanted tags$old_data=$data;$data=preg_replace('#
]*+>#i','',$data);}while($old_data!==$data);// we are done...return $data;}
Articles you may be interested in
- Common PHP anti-injection vulnerability filtering function code
- Php extracts the birthday date from the ID card number and verifies whether it is a minor.
- PHP checks browser parameters to prevent SQL injection.
- Measures to prevent website attacks
- Jquery + html + php implement Ajax without refreshing file Upload
- Php judges the day of the month as the day of the week
- Php programmer interview questions-common basic questions and answers (1)
- Use php functions in the smarty template and how to use multiple functions for a variable in the smarty Template
...