PHP XSS filtering

The XSS is also called the CSS (cross site script), which is an attack by the site. It refers to a malicious attacker inserting malicious HTML code into a Web page, and when the user browses to the page, the HTML code embedded inside the Web is executed to achieve the purpose of some people's attack.

Below is a piece of code in thinkphp to filter XSS

thinkphp\code\thinkphp\common\extend.php

    
            Note that you had to handle splits with \ n, \ r, and \ t later since they *are* allowed in some inputs                  $val = Preg_replace ('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/', ' ', $val);             Straight replacements, the user should never need these since they ' re normal characters//This prevents like          $search = ' abcdefghijklmnopqrstuvwxyz ';           $search. = ' ABCDEFGHIJKLMNOPQRSTUVWXYZ ';          $search. = ' 1234567890!@#$%^&* () ';          $search. = ' ~ ';:? +/={}[]-_|\ ' \ \ '; for ($i = 0; $i < strlen ($search); $i + +) {//; matches the;, which is optional//0{0,7} mat             Ches any padded zeros, which is optional and go up to 8 chars//@ search for the hex values $val = Preg_replace ('/(&#[xx]0{0,8} '. Dechex (Ord ($search [$i])). /I ', $search [$i], $val);             with A; @ @ 0{0,7} matches ' 0 ' zero to seven times $val = Preg_replace ('/(? { 0,8} '. Ord($search [$i]). /', $search [$i], $val);          with A; }//Now the only remaining whitespace attacks is \ t, \ n, and \ r $ra 1 = Array (' javascript ', ' VBS Cript ', ' expression ', ' applets ', ' meta ', ' xml ', ' blink ', ' link ', ' style ', ' script ', ' embed ', ' object ', ' iframe ', ' frame ', '          Frameset ', ' ilayer ', ' layer ', ' bgsound ', ' title ', ' base '); $ra 2 = Array (' onabort ', ' onactivate ', ' onafterprint ', ' onafterupdate ', ' onbeforeactivate ', ' onbeforecopy ', ' Onbeforecut ', ' onbeforedeactivate ', ' onbeforeeditfocus ', ' onbeforepaste ', ' onbeforeprint ', ' onbeforeunload ', ' Onbeforeupdate ', ' onblur ', ' onbounce ', ' oncellchange ', ' onchange ', ' onclick ', ' oncontextmenu ', ' oncontrolselect ', ' Oncopy ', ' oncut ', ' ondataavailable ', ' ondatasetchanged ', ' ondatasetcomplete ', ' ondblclick ', ' ondeactivate ', ' Ondrag ', ' Ondragend ', ' ondragenter ', ' ondragleave ', ' ondragover ', ' ondragstart ', ' ondrop ', ' onerror ', ' onerrorupdate ', ' Onfilterchange ', ' onfinish ', ' onfocus ', ' onfocusin ', ' OnfocusouT ', ' onhelp ', ' onkeydown ', ' onkeypress ', ' onkeyup ', ' onlayoutcomplete ', ' onload ', ' onlosecapture ', ' onmousedown ', ' Onmouseenter ', ' onmouseleave ', ' onmousemove ', ' onmouseout ', ' onmouseover ', ' onmouseup ', ' onmousewheel ', ' onmove ', ' Onmoveend ', ' onmovestart ', ' onpaste ', ' onpropertychange ', ' onreadystatechange ', ' onreset ', ' onresize ', ' onresizeend ', ' Onresizestart ', ' onrowenter ', ' onrowexit ', ' onrowsdelete ', ' onrowsinserted ', ' onscroll ', ' onselect ', '          Onselectionchange ', ' onselectstart ', ' onstart ', ' onstop ', ' onsubmit ', ' onunload ');                 $ra = Array_merge ($ra 1, $ra 2); $found = true; Keep replacing as long as the previous round replaced something while ($found = = True) {$val _befo             re = $val;                for ($i = 0; $i < sizeof ($RA); $i + +) {$pattern = '/';                       for ($j = 0; $j < strlen ($ra [$i]); $j + +) {if ($j > 0) {$pattern. = ' ('; $pattern. = ' (&#[xx]0{0,8} ([9ab]);) ';                       $pattern. = ' | '; $pattern. = ' | (? {0,8}                      ([9|10|13]);) ';                   $pattern. = ') * ';                } $pattern. = $ra [$i] [$j];                 } $pattern. = '/I '; $replacement = substr ($ra [$i], 0, 2). '
 
  
   '. substr ($ra [$i], 2);//Add in <> to nerf the tag $val = Preg_replace ($pattern, $replacement, $val); Filter out the hex tags if ($val _before = = $val) {//No replacements were made, so                 Exit the loop $found = false;        }}} return $val;      }//test the effect//echo REMOVEXSS (""); ?>
  
 

There is also a tool: HTML purifier, more than the above document efficiency one times, want to know how funeral, and listen to tell.

