萬盛學電腦網

 萬盛學電腦網 >> 網絡編程 >> php編程 >> php預防XSS攻擊,ajax跨域攻擊的方法

php預防XSS攻擊,ajax跨域攻擊的方法

   對網站發動XSS攻擊的方式有很多種,僅僅使用php的一些內置過濾函數是對付不了的,即使你將filter_var,mysql_real_escape_string,htmlentities,htmlspecialchars,strip_tags這些函數都使用上了也不一定能保證絕對的安全。

  現在有很多php開發框架都提供關於防XSS攻擊的過濾方法,下面和大家分享一個預防XSS攻擊和ajax跨域攻擊的函數,摘自某開發框架,相比於僅僅使用內置函數應該還是夠強了的吧。

  function xss_clean($data){

  // Fix &entityn;

  $data=str_replace(array('&','<','>'),array('&','<','>'),$data);

  $data=preg_replace('/(&#*w+)[x00-x20]+;/u','$1;',$data);

  $data=preg_replace('/(&#x*[0-9A-F]+);*/iu','$1;',$data);

  $data=html_entity_decode($data,ENT_COMPAT,'UTF-8');

  // Remove any attribute starting with "on" or xmlns

  $data=preg_replace('#(<[^>]+?[x00-x20"'])(?:onxmlns)[^>]*+>#iu','$1>',$data);

  // Remove javascript: and vbscript: protocols

  $data=preg_replace('#([a-z]*)[x00-x20]*=[x00-x20]*([`'"]*)[x00-x20]*j[x00-x20]*a[x00-x20]*v[x00-x20]*a[x00-x20]*s[x00-x20]*c[x00-x20]*r[x00-x20]*i[x00-x20]*p[x00-x20]*t[x00-x20]*:#iu','$1=$2nojavascript...',$data);

  $data=preg_replace('#([a-z]*)[x00-x20]*=(['"]*)[x00-x20]*v[x00-x20]*b[x00-x20]*s[x00-x20]*c[x00-x20]*r[x00-x20]*i[x00-x20]*p[x00-x20]*t[x00-x20]*:#iu','$1=$2novbscript...',$data);

  $data=preg_replace('#([a-z]*)[x00-x20]*=(['"]*)[x00-x20]*-moz-binding[x00-x20]*:#u','$1=$2nomozbinding...',$data);

  // Only works in IE:

  $data=preg_replace('#(<[^>]+?)style[x00-x20]*=[x00-x20]*[`'"]*.*?expression[x00-x20]*([^>]*+>#i','$1>',$data);

  $data=preg_replace('#(<[^>]+?)style[x00-x20]*=[x00-x20]*[`'"]*.*?behaviour[x00-x20]*([^>]*+>#i','$1>',$data);

  $data=preg_replace('#(<[^>]+?)style[x00-x20]*=[x00-x20]*[`'"]*.*?s[x00-x20]*c[x00-x20]*r[x00-x20]*i[x00-x20]*p[x00-x20]*t[x00-x20]*:*[^>]*+>#iu','$1>',$data);

  // Remove namespaced elements (we do not need them)

  $data=preg_replace('#]*+>#i','',$data);

  // http://www.Alixixi.com/

  do{// Remove really unwanted tags

  $old_data=$data;

  $data=preg_replace('#]*+>#i','',$data);

  }while($old_data!==$data);

  // we are done...

  return $data;

  }

copyright © 萬盛學電腦網 all rights reserved