thinkphp2.x method to prevent XSS cross-station attack _php instance

This example describes the thinkphp2.x approach to preventing XSS cross-site attacks. Share to everyone for your reference. Specifically as follows:

have been using thinkphp2.x, through the dark clouds have to submit a thinkphp XSS attack bug, take a moment to look at.

The principle is to pass the URL to the script tag, thinkphp error page directly output script.

Principle:

Http://ask.lenovo.com.cn/index.php?s=1%3Cbody+onload=alert (1)%3e

Where the value of M is a nonexistent module and is a complete script that is executed in the exception error page to implement an XSS Cross-site attack.

Precautionary method:

Find the Exception error page template ThinkException.tpl.php (2,x), THINK_EXCEPTION.TPL (3.x) has two places to modify:

Line 57th

Copy Code code as follows:

Echo ($_server[' php_self '])

To

Copy Code code as follows:

echo strip_tags ($_server[' php_self ')

Line 62nd

Copy Code code as follows:

echo $e [' message ']

To

Copy Code code as follows:

Echo strip_tags ($e [' message '])

In addition, thinkphp since 3.0 official has been to TP variable group_name,module_name,action_name,__url__,__self__,__app__,$_server[' PHP_SELF ' Done a safe deal.

PS: Security is not the responsibility of the framework, everyone should pay attention to when developing.

I hope this article will help you with the PHP program design based on thinkphp framework.