How the thinkphp framework effectively prevents xss attacks

Currently, thinkphp3.1.3 is used. It seems that this version of thinkphp filters url and form submission by default, because adding malicious js scripts to some search boxes and url parameters is not executed, but I still don't feel at ease. thinkphp does not take long for this framework, but xss should... currently, thinkphp3.1.3 is used. It seems that this version of thinkphp filters url and form submission by default, because adding malicious js scripts to some search boxes and url parameters is not executed, however, I still don't feel at ease. thinkphp does not take long for this framework, but xss is now growing. I would like to ask you some experienced users about the thinkphp configuration, or what filtering code is added where a user submits the code to make the website more effective against xss attacks?

Reply content:

Currently, thinkphp3.1.3 is used. It seems that this version of thinkphp filters url and form submission by default, because adding malicious js scripts to some search boxes and url parameters is not executed, however, I still don't feel at ease. thinkphp does not take long for this framework, but xss is now growing. I would like to ask you some experienced users about the thinkphp configuration, or what filtering code is added where a user submits the code to make the website more effective against xss attacks?

XSS (cross-site scripting attacks) can be used to steal Cookie information of other users. To avoid such problems, the following solutions can be used:
1. Filter all JavaScript scripts directly;
2. Escape Html metacharacters and use functions such as htmlentities and htmlspecialchars;
3. The extended function library of the system provides the remove_xss Method for XSS Security filtering;
4. Perform XSS on some system variables accessed by the URL.

Related:
Http://www.hdj.me/thinkphp-deny-xss
Http://www.2cto.com/Article/201307/231292.html
Http://www.oschina.net/question/582888_117471

function remove_xss($val) {   // remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed   // this prevents some character re-spacing such as 
  
      // note that you have to handle splits with \n, \r, and \t later since they *are* allowed in some inputs   $val = preg_replace('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/', '', $val);   // straight replacements, the user should never need these since they're normal characters   // this prevents like    $search = 'abcdefghijklmnopqrstuvwxyz';   $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';   $search .= '1234567890!@#$%^&*()';   $search .= '~`";:?+/={}[]-_|\'\\';   for ($i = 0; $i < strlen($search); $i++) {      // ;? matches the ;, which is optional      // 0{0,7} matches any padded zeros, which are optional and go up to 8 chars      // @ @ search for the hex values      $val = preg_replace('/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i', $search[$i], $val); // with a ;      // @ @ 0{0,7} matches '0' zero to seven times      $val = preg_replace('/(�{0,8}'.ord($search[$i]).';?)/', $search[$i], $val); // with a ;   }   // now the only remaining whitespace attacks are \t, \n, and \r   $ra1 = array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'style', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base');   $ra2 = array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload');   $ra = array_merge($ra1, $ra2);   $found = true; // keep replacing as long as the previous round replaced something   while ($found == true) {      $val_before = $val;      for ($i = 0; $i < sizeof($ra); $i++) {         $pattern = '/';         for ($j = 0; $j < strlen($ra[$i]); $j++) {            if ($j > 0) {               $pattern .= '(';               $pattern .= '(&#[xX]0{0,8}([9ab]);)';               $pattern .= '|';               $pattern .= '|(�{0,8}([9|10|13]);)';               $pattern .= ')*';            }            $pattern .= $ra[$i][$j];         }         $pattern .= '/i';         $replacement = substr($ra[$i], 0, 2).'
   
    '.substr($ra[$i], 2); // add in <> to nerf the tag         $val = preg_replace($pattern, $replacement, $val); // filter out the hex tags         if ($val_before == $val) {            // no replacements were made, so exit the loop            $found = false;         }      }   }   return $val;}
   
  

What ~ Whenever I make some contributions to you, I feel the red scarf on my chest is brighter.