PHP and XSS cross-site attack _ PHP Tutorial

PHP and XSS cross-site attacks. In fact, this topic has been mentioned for a long time, and many PHP sites in China are found to have XSS vulnerabilities. I accidentally saw an XSS vulnerability in PHP5 today. here is a summary. By the way, PHP5 friends In fact, this topic has been mentioned for a long time, and many PHP sites in China are found to have XSS vulnerabilities. I accidentally saw an XSS vulnerability in PHP5 today. here is a summary. By the way, it is recommended that you use PHP5 to install a patch or upgrade it.

If you don't know what XSS is, you can read it here or here (Chinese may be better understood ).

Many forums in China have cross-site scripting vulnerabilities. for example, here is an example of a Google Hack + XSS attack targeting Discuz. 4.0.0RC3. There are also many such examples abroad, and even Google has appeared, but it was fixed at the beginning of December. Cross-site attacks can be easily constructed and are very concealed and difficult to detect (usually jump back to the original page immediately after information is stolen ).
How to attack is not described here(Do not ask me). it mainly talks about how to prevent it. First, cross-site scripting attacks are caused by the absence of strict filtering of user input. Therefore, we must block possible dangers before all data enters our website and database. For illegal HTML code, including single and double quotation marks, you can use Htmlentities ().

$ Str = "A quote isBold";

// Outputs: A quote is <B> bold </B>
Echo htmlentities ($ str );

// Outputs: A 'quote' is <B> bold </B>
Echo htmlentities ($ str, ENT_QUOTES );
?>


In this way, invalid scripts can be invalidated.

Note that, htmlentities()The default encoding is ISO-8859-1, and if your illegal script code is other, it may not be filtered out, while the browser can recognize and execute. To solve this problem, I need to test several sites first.

Here is a function for filtering out invalid scripts:

Function RemoveXSS ($ val ){
// Remove all non-printable characters. CR (0a) and LF (0b) and TAB (9) are allowed
// This prevents some character re-spacing such
// Note that you have to handle splits with, and later since they * are * allowed in some inputs
$ Val = preg_replace (/([x00-x08] [x0b-x0c] [x0e-x20])/, $ val );

// Straight replacements, the user shoshould never need these since theyre normal characters
// This prevents like
$ Search = abcdefghijklmnopqrstuvwxyz;
$ Search. = ABCDEFGHIJKLMNOPQRSTUVWXYZ;
$ Search. = 1234567890! @ # $ % ^ &*();
$ Search. = ~ '";:? +/= {} []-_ | \;
For ($ I = 0; $ I <strlen ($ search); $ I ++ ){
//;? Matches the;, which is optional
// 0 {0, 7} matches any padded zeros, which are optional and go up to 8 chars

// @ Search for the hex values
$ Val = preg_replace (/(& # [x | X] 0 {0, 8}. dechex (ord ($ search [$ I]).;?) /I, $ search [$ I], $ val); // with;
// @ 0 {0, 7} matches 0 zero to seven times
$ Val = preg_replace (/({0, 8}. ord ($ search [$ I]).;?) //, $ Search [$ I], $ val); // with;
}

// Now the only remaining whitespace attacks are, and
$ Ra1 = Array (javascript, vbscript, expression, applet, meta, xml, blink, link, style, script, embed, object, iframe, frame, frameset, ilayer, layer, bgsound, title, base );
$ Ra2 = Array (onabort, onactivate, onafterprint, onafterupdate, timeout, onbeforeeditfocus, timeout, onbeforeprint, response, onbeforeupdate, onblur, onbounce, oncellchange, onchange, onclick, oncontextmenu, oncontrolselect, oncopy, oncut, ondataavailable, ondatasetchanged, ondatasetcomplete, ondblclick, ondeactivate, ondrag, ondragend, ondragenter, ondragleave, ondragover, ondragstart,

Bytes. I accidentally saw an XSS vulnerability in PHP5 today. here is a summary. By the way, I would like to remind you to use PHP5...