PHP protection against XSS attacks

XSS is all called Cross Site Scripting, and the user intentionally or unintentionally enters some malicious characters in the form, which destroys the performance of the page!

Look at common malicious characters for XSS input:

1.XSS input typically contains JavaScript scripts, such as pop-up malicious warning boxes: <script>alert ("XSS");</script>

The 2.XSS input may also be an HTML code snippet, such as:

(1). The webpage constantly refreshes <meta http-equiv= "refresh" content= "0;" >

(2). Links embedded in other websites <iframe src=http://xxxx width=250 height=250></iframe>

<?PHP/** * @blog http://www.phpddt.com * @param $string * @param $low safety level low*/    functionCLEAN_XSS (&$string,$low=False)    {        if(!Is_array($string ))        {            $string=Trim($string ); $string=Strip_tags($string ); $string=Htmlspecialchars($string ); if($low)            {                return True; }            $string=Str_replace(Array(‘"‘, "\\", "‘", "/", "..", ".. /", "./", "//" ), ‘‘,$string ); $no= '/%0[0-8bcef]/'; $string=Preg_replace($no, ‘‘,$string ); $no= '/%1[0-9a-f]/'; $string=Preg_replace($no, ‘‘,$string ); $no= '/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]+/s '; $string=Preg_replace($no, ‘‘,$string ); return True; }        $keys=Array_keys($string ); foreach($keys  as $key) {CLEAN_XSS ($string[$key] ); }    }    //just a test    $str= ' Phpddt.com<meta http-equiv= ' "Refresh" content= "0;" > '; CLEAN_XSS ($str);//If you comment this out, you know the XSS attack is awesome.    Echo $str; ?>

PHP protection against XSS attacks