PHP Common XSS attack filtering function, Discuz system to prevent XSS vulnerability attacks, filtering HTML hazard tag properties of PHP functions

XSS attacks in the recent very popular, often in a piece of code accidentally will be put on the code of XSS attack, see someone abroad written function, I also stole lazy, quietly posted up ...
The original text reads as follows:

The goal of this function was to being

a generic function that can being used to parse almost any input and render it XSS s Afe. For more information on actual XSS attacks, check out http://ha.ckers.org/xss.html. Another excellent site is the XSS Database which details for attack and how it works.

<?phpfunction REMOVEXSS ($val) {//Remove all non-printable characters.  CR (0a) and LF (0b) and TAB (9) is allowed//This prevents some character re-spacing such as <javascript>//Note That's all to handle splits with, and later since they *are* allowed in some inputs $val = Preg_replace ('/([x00-     X08,X0B-X0C,X0E-X19])/', ', $val);  Straight replacements, the user should never need these since they ' re normal characters//This prevents like  $search = ' abcdefghijklmnopqrstuvwxyz ';   $search. = ' ABCDEFGHIJKLMNOPQRSTUVWXYZ ';   $search. = ' [email protected]#$%^&* () '; $search. = ' ~ ' ";:? +/={}[]-_| '   \‘;  for ($i = 0; $i < strlen ($search); $i + +) {//; matches the;, which is optional//0{0,7} matches any padded zeros, Which is optional and go up to 8 chars//@ search for the hex values $val = Preg_replace ('/(&#[xx]0{0,8} '. Dech Ex (ORD ($search [$i]). /I ', $search [$i], $val); With a ; @ 0{0,7} matches ' 0 ' zero to seven times $val = Preg_replace ('/(& #0 {0,8} '. Ord ($search [$i]). /', $search [$i], $val);   with A; }//Now the only remaining whitespace attacks is,, and $ra 1 = Array (' javascript ', ' VBScript ', ' expression ', ' app Let ', ' meta ', ' xml ', ' blink ', ' link ', ' style ', ' script ', ' embed ', ' object ', ' iframe ', ' frame ', ' frameset ', ' ilayer ', ' Laye   R ', ' Bgsound ', ' title ', ' base '); $ra 2 = Array (' onabort ', ' onactivate ', ' onafterprint ', ' onafterupdate ', ' onbeforeactivate ', ' onbeforecopy ', ' Onbeforecut ', ' onbeforedeactivate ', ' onbeforeeditfocus ', ' onbeforepaste ', ' onbeforeprint ', ' onbeforeunload ', ' Onbeforeupdate ', ' onblur ', ' onbounce ', ' oncellchange ', ' onchange ', ' onclick ', ' oncontextmenu ', ' oncontrolselect ', ' Oncopy ', ' oncut ', ' ondataavailable ', ' ondatasetchanged ', ' ondatasetcomplete ', ' ondblclick ', ' ondeactivate ', ' Ondrag ', ' Ondragend ', ' ondragenter ', ' ondragleave ', ' ondragover ', ' ondragstart ', ' ondrop ', ' onerror ', ' onerrorupdate ', ' OnfilterchanGE ', ' onfinish ', ' onfocus ', ' onfocusin ', ' onfocusout ', ' onhelp ', ' onkeydown ', ' onkeypress ', ' onkeyup ', ' Onlayoutcomplete ', ' onload ', ' onlosecapture ', ' onmousedown ', ' onmouseenter ', ' onmouseleave ', ' onmousemove ', ' onMouseOut ', ' onmouseover ', ' onmouseup ', ' onmousewheel ', ' onmove ', ' onmoveend ', ' onmovestart ', ' onpaste ', ' Onpropertychange ', ' onreadystatechange ', ' onreset ', ' onresize ', ' onresizeend ', ' onresizestart ', ' onrowenter ', ' Onrowexit ', ' onrowsdelete ', ' onrowsinserted ', ' onscroll ', ' onselect ', ' onselectionchange ', ' onselectstart ', ' OnStart '   , ' OnStop ', ' onsubmit ', ' onunload ');    $ra = Array_merge ($ra 1, $ra 2); $found = true;  Keep replacing as long as the previous round replaced something while ($found = = True) {$val _before = $val;   for ($i = 0; $i < sizeof ($RA); $i + +) {$pattern = '/'; for ($j = 0; $j < strlen ($ra [$i]); $j + +) {if ($j > 0) {   $pattern. = ' (';   $pattern. = ' (&#[xx]0{0,8} ([9ab]);) ';   $pattern. = ' | '; $pattern. = ' |  (& #0 {0,8} ([9|10|13]);) '; $pattern. = ') * ';} $pattern. = $ra [$i] [$j]; } $pattern. = '/I '; $replacement = substr ($ra [$i], 0, 2). ' <x> '. substr ($ra [$i], 2); Add in <> to nerf the tag $val = Preg_replace ($pattern, $replacement, $val);  Filter out the hex tags if ($val _before = = $val) {//No. replacements were made, so exit the Loop$found = FALSE;} }} return $val;}? >

After such a filter, the chance of being attacked will be much less? Try it?

PHP functions in Discuz system to prevent XSS exploits and filter HTML Hazard tag Properties

Shielded Htmlfunction checkhtml ($html) {$html = Stripslashes ($html), if (!checkperm (' allowhtml ')) {Preg_match_all ("/< ([ ^<]+) >/is ", $html, $ms); $searchs [] = ' < '; $replaces [] = ' < '; $searchs [] = ' > '; $replaces [] = ' > '; if ($ms [1 ]) {$allowtags = ' img|a|font|div|table|tbody|caption|tr|td|th|br|p|b|strong|i|u|em|span|ol|ul|li|blockquote| Object|param|embed ';//Allowed label $ms[1] = Array_unique ($ms [1]), foreach ($ms [1] as $value) {$searchs [] = "<". $value. " > "; $value = Shtmlspecialchars ($value); $value = str_replace (Array (' \ ', '/* '), array ('. ', '/. '), $value); $skipkeys = Array (' onabort ', ' onactivate ', ' onafterprint ', ' onafterupdate ', ' onbeforeactivate ', ' onbeforecopy ', ' onbeforecut ', ' Onbeforedeactivate ', ' onbeforeeditfocus ', ' onbeforepaste ', ' onbeforeprint ', ' onbeforeunload ', ' onbeforeupdate ', ' Onblur ', ' onbounce ', ' oncellchange ', ' onchange ', ' onclick ', ' oncontextmenu ', ' oncontrolselect ', ' oncopy ', ' oncut ', ' OnDataAvailable ', ' ondatasetchanged ', ' ondatasetcomplete ', ' ondblclick ', ' ondeactivate ', ' Ondrag ', ' ondragend ',' OnDragEnter ', ' ondragleave ', ' ondragover ', ' ondragstart ', ' ondrop ', ' onerror ', ' onerrorupdate ', ' onfilterchange ', ' OnFinish ', ' onfocus ', ' onfocusin ', ' onfocusout ', ' onhelp ', ' onkeydown ', ' onkeypress ', ' onkeyup ', ' onlayoutcomplete ', ' OnLoad ', ' onlosecapture ', ' onmousedown ', ' onmouseenter ', ' onmouseleave ', ' onmousemove ', ' onmouseout ', ' onmouseover ', ' OnMouseUp ', ' onmousewheel ', ' onmove ', ' onmoveend ', ' onmovestart ', ' onpaste ', ' onpropertychange ', ' onreadystatechange ' , ' onreset ', ' onresize ', ' onresizeend ', ' onresizestart ', ' onrowenter ', ' onrowexit ', ' onrowsdelete ', ' onrowsinserted ', ' Onscroll ', ' onselect ', ' onselectionchange ', ' onselectstart ', ' onstart ', ' onstop ', ' onsubmit ', ' onunload ', ' JavaScript ' , ' script ', ' eval ', ' behaviour ', ' expression ', ' style ', ' class '), $skipstr = Implode (' | ', $skipkeys); $value = Preg_replace (Array ("/($SKIPSTR)/I"), '. ', $value), if (!preg_match ("/^[/|s]?" ( $allowtags) (s+|$)/is ", $value)) {$value = ';} $replaces [] = Empty ($value)? ":" < ". Str_replace ('" ', ' "', $value)." > ";}} $html = Str_replace ($searchs, $replaces, $HTML);} $html = Addslashes ($html); return $html;}

PHP Common XSS attack filtering function, Discuz system to prevent XSS vulnerability attacks, filtering HTML hazard tag Properties of PHP functions