What XSS attacks? PHP functions to prevent XSS attacks

XSS is called Cross Site Scripting. users intentionally or unintentionally enter malicious characters in the form, thus damaging the page performance!

Take a look at common malicious characters XSS input:

1. XSS input usually contains JavaScript scripts. For example, a malicious warning box is displayed: <script> alert ("XSS"); </script>

2. XSS input may also be an HTML code segment, for example:

(1). the webpage keeps refreshing <meta http-equiv = "refresh" content = "0;">

(2). Link embedding other websites <iframe src = http: // xxxx width = 250 height = 250> </iframe>

Test path to prevent XSS attacks:

 
In fact, there are many tools to test XSS attacks:

• Paros proxy (http://www.parosproxy.org)
• Fiddler (http://www.fiddlertool.com/fiddler)
• Burp proxy (http://www.portswigger.net/proxy)
• TamperIE (http://www.bayden.com/dl/TamperIESetup.exe)

How can PHP developers prevent XSS attacks?( Functions of php to prevent xss attacks)
You can use the following functions:

<? PHP/*** @ blog http://www.phpddt.com * @ param $ string * @ param $ low security level low */function clean_xss (& $ string, $ low = False) {if (! Is_array ($ string) {$ string = trim ($ string); $ string = strip_tags ($ string); $ string = htmlspecialchars ($ string); if ($ low) {return True;} $ string = str_replace (array ('"',"\\","'","/",".. ",".. /",". /"," // "),'', $ string); $ no = '/% 0 [0-8bcef]/'; $ string = preg_replace ($ no ,'', $ string); $ no = '/% 1 [0-9a-f]/'; $ string = preg_replace ($ no, '', $ string ); $ no = '/[\ x00-\ x08 \ x0B \ x0C \ x0E -\ X1F \ x7F] +/s'; $ string = preg_replace ($ no, '', $ string); return True ;}$ keys = array_keys ($ string ); foreach ($ keys as $ key) {clean_xss ($ string [$ key]) ;}// just a test $ str = 'phpddt. com <meta http-equiv = "refresh" content = "0;"> '; clean_xss ($ str); // If you comment out this, you will know that xss attacks are amazing echo $ str;?>

Clean_xss () is used to filter malicious content!
In addition, this article draws on the IBM website this article: https://www.ibm.com/developerworks/cn/opensource/os-cn-php-xss/