php过滤XSS攻击的函数

本文格式为Word版，下载可任意编辑——php过滤XSS攻击的函数php过滤XSS攻击的函数

本文共享一例防范XSS攻击的.php函数代码，学习下在php中防范XSS攻击的方法，有需要的挚友参考学习下。就跟随我一起去了解下吧，想了解更多相关信息请持续关注我们我!

过滤XSS攻击

以下函数：

过滤用户的输入，保证输入是XSS安好的。

例子：

复制代码代码例如:

?php

/**

*过滤XSS攻击

*edit:.

*/

functionRemoveXSS$val

//removeallnon-printablecharacters.CR0aandLF0bandTAB9areallowed

//thispreventssomecharacterre-spacingsuchasjava\0script

//notethatyouhavetohandlesplitswith\n,\r,and\tlatersincethey*are*allowedinsomeinputs

$val=preg_replace/[\x00-\x08,\x0b-\x0c,\x0e-\x19]/,,$val;

//straightreplacements,theusershouldneverneedthesesincetheyrenormalcharacters

//thispreventslikeIMGSRC=@avascript:alertXSS

$search=abcdefghijklmnopqrstuvwxyz;

$search.=ABCDEFGHIJKLMNOPQRSTUVWXYZ;

$search.=1234567890!@#$%^*;

$search.=~`;:?+/=[]-_|\\\;

for$i=0;$istrlen$search;$i++

//;?matchesthe;,whichisoptional

//00,7matchesanypaddedzeros,whichareoptionalandgoupto8chars

//@@searchforthehexvalues

$val=preg_replace/#[xX]00,8.dechexord$search[$i].;?/i,$search[$i],$val;//witha;

//@@00,7matches0zerotoseventimes

$val=preg_replace/?0,8.ord$search[$i].;?/,$search[$i],$val;//witha;

//nowtheonlyremainingwhitespaceattacksare\t,\n,and\r

$ra1=Arrayjavascript,vbscript,expression,applet,meta,xml,blink,link,style,script,embed,object,iframe,frame,frameset,ilayer,layer,bgsound,title,base;

$ra2=Arrayonabort,onactivate,onafterprint,onafterupdate,onbeforeactivate,onbeforecopy,onbeforecut,onbeforedeactivate,onbeforeeditfocus,onbeforepaste,onbeforeprint,onbeforeunload,onbeforeupdate,onblur,onbounce,oncellchange,onchange,onclick,oncontextmenu,oncontrolselect,oncopy,oncut,ondataavailable,ondatasetchanged,ondatasetcomplete,ondblclick,ondeactivate,ondrag,ondragend,ondragenter,ondragleave,ondragover,ondragstart,ondrop,onerror,onerrorupdate,onfilterchange,onfinish,onfocus,onfocusin,onfocusout,onhelp,onkeydown,onkeypress,onkeyup,onlayoutcomplete,onload,onlosecapture,onmousedown,onmouseenter,onmouseleave,onmousemove,onmouseout,onmouseover,onmouseup,onmousewheel,onmove,onmoveend,onmovestart,onpaste,onpropertychange,onreadystatechange,onreset,onresize,onresizeend,onresizestart,onrowenter,onrowexit,onrowsdelete,onrowsinserted,onscroll,onselect,onselectionchange,onselectstart,onstart,onstop,onsubmit,onunload;

$ra=array_merge$ra1,$ra2;

$found=true;//keepreplacingaslongasthepreviousroundreplacedsomething

while$found==true

$val_before=$val;

for$i=0;$isizeof$ra;$i++

$pattern=/;

for$j=0;$jstrlen$ra[$i];$j++

if$j0

$pattern.=;

$pattern.=#[xX]00,8[9ab];;

$pattern.=|;

$pattern.=|?0,8[9|10|13];;

$pattern.=*;

$pattern.=$ra[$i][$j];

$pattern.=/i;

$replacement=substr$ra[$i],0,2.x.substr$ra[$i],2;//addintonerfthetag

$val=preg_replace$pattern,$repla