PHP and XSS cross-site attacks_PHP tutorial-PHP Tutorial-php.cn

Home

Backend Development

PHP Tutorial

PHP and XSS cross-site attacks_PHP tutorial

WBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWB

Jul 13, 2016 pm 05:34 PM

phpxssDiscoveranddomesticattacksitethis

其实这个话题很早就想说说了，发现国内不少PHP站点都有XSS漏洞。今天偶然看到PHP5的一个XSS漏洞，在此小结一下。顺便提醒，使用PHP5的朋友最好打下补丁，或者升级一下。

如果你不懂什么是XSS，可以看这里，或者这里（中文的也许会好懂一些）。

国内不少论坛都存在跨站脚本漏洞，例如这里有一个Google Hack+XSS的攻击例子，针对的是Discuz 4.0.0RC3。国外也很多这样的例子，甚至Google也出现过，不过在12月初时修正了。跨站攻击很容易就可以构造，而且非常隐蔽，不易被查觉（通常盗取信息后马上跳转回原页面）。
如何攻击，在此不作说明（也不要问我），主要谈谈如何防范。首先，跨站脚本攻击都是由于对用户的输入没有进行严格的过滤造成的，所以我们必须在所有数据进入我们的网站和数据库之前把可能的危险拦截。针对非法的HTML代码包括单双引号等，可以使用htmlentities() 。

<?php $str = "A quote is bold"; // Outputs: A quote is bold echo htmlentities($str); // Outputs: A 'quote' is bold echo htmlentities($str, ENT_QUOTES); ?> 这样可以使非法的脚本失效。 
但是要注意一点，htmlentities()默认编码为 ISO-8859-1，如果你的非法脚本编码为其它，那么可能无法过滤掉，同时浏览器却可以识别和执行。这个问题我先找几个站点测试后再说。

这里提供一个过滤非法脚本的函数：

function RemoveXSS($val) { // remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed // this prevents some character re-spacing such as <javascript></javascript> // note that you have to handle splits with , , and later since they *are* allowed in some inputs $val = preg_replace(/([x00-x08][x0b-x0c][x0e-x20])/, , $val); // straight replacements, the user should never need these since theyre normal characters // this prevents like <img src="@avascript:alert('XSS')" alt="PHP and XSS cross-site attacks_PHP tutorial" > $search = abcdefghijklmnopqrstuvwxyz; $search .= ABCDEFGHIJKLMNOPQRSTUVWXYZ; $search .= 1234567890!@#$%^&*(); $search .= ~`";:?+/={}[]-_|; for ($i = 0; $i // ;? matches the ;, which is optional // 0{0,7} matches any padded zeros, which are optional and go up to 8 chars // @ @ search for the hex values $val = preg_replace(/([x|X]0{0,8}.dechex(ord($search[$i])).;?)/i, $search[$i], $val); // with a ; // @ @ 0{0,7} matches 0 zero to seven times $val = preg_replace(/({0,8}.ord($search[$i]).;?)/, $search[$i], $val); // with a ; } // now the only remaining whitespace attacks are , , and $ra1 = Array(javascript, vbscript, expression, applet, meta, xml, blink, link, style, script, embed, object, iframe, frame, frameset, ilayer, layer, bgsound, title, base); $ra2 = Array(onabort, onactivate, onafterprint, onafterupdate, onbeforeactivate, onbeforecopy, onbeforecut, onbeforedeactivate, onbeforeeditfocus, onbeforepaste, onbeforeprint, onbeforeunload, onbeforeupdate, onblur, onbounce, oncellchange, onchange, onclick, oncontextmenu, oncontrolselect, oncopy, oncut, ondataavailable, ondatasetchanged, ondatasetcomplete, ondblclick, ondeactivate, ondrag, ondragend, ondragenter, ondragleave, ondragover, ondragstart, <fo> <div style="display:none;"> http://www.bkjia.com/PHPjc/508507.htmlwww.bkjia.comtruehttp://www.bkjia.com/PHPjc/508507.htmlTechArticle其实这个话题很早就想说说了，发现国内不少PHP站点都有XSS漏洞。今天偶然看到PHP5的一个XSS漏洞，在此小结一下。顺便提醒，使用PHP5的朋... </div></fo>

Statement

The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

PHP vs. Python: Understanding the DifferencesApr 11, 2025 am 12:15 AM

PHP and Python each have their own advantages, and the choice should be based on project requirements. 1.PHP is suitable for web development, with simple syntax and high execution efficiency. 2. Python is suitable for data science and machine learning, with concise syntax and rich libraries.

PHP: Is It Dying or Simply Adapting?Apr 11, 2025 am 12:13 AM

PHP is not dying, but constantly adapting and evolving. 1) PHP has undergone multiple version iterations since 1994 to adapt to new technology trends. 2) It is currently widely used in e-commerce, content management systems and other fields. 3) PHP8 introduces JIT compiler and other functions to improve performance and modernization. 4) Use OPcache and follow PSR-12 standards to optimize performance and code quality.

The Future of PHP: Adaptations and InnovationsApr 11, 2025 am 12:01 AM

The future of PHP will be achieved by adapting to new technology trends and introducing innovative features: 1) Adapting to cloud computing, containerization and microservice architectures, supporting Docker and Kubernetes; 2) introducing JIT compilers and enumeration types to improve performance and data processing efficiency; 3) Continuously optimize performance and promote best practices.

When would you use a trait versus an abstract class or interface in PHP?Apr 10, 2025 am 09:39 AM

In PHP, trait is suitable for situations where method reuse is required but not suitable for inheritance. 1) Trait allows multiplexing methods in classes to avoid multiple inheritance complexity. 2) When using trait, you need to pay attention to method conflicts, which can be resolved through the alternative and as keywords. 3) Overuse of trait should be avoided and its single responsibility should be maintained to optimize performance and improve code maintainability.

What is a Dependency Injection Container (DIC) and why use one in PHP?Apr 10, 2025 am 09:38 AM

Dependency Injection Container (DIC) is a tool that manages and provides object dependencies for use in PHP projects. The main benefits of DIC include: 1. Decoupling, making components independent, and the code is easy to maintain and test; 2. Flexibility, easy to replace or modify dependencies; 3. Testability, convenient for injecting mock objects for unit testing.

Explain the SPL SplFixedArray and its performance characteristics compared to regular PHP arrays.Apr 10, 2025 am 09:37 AM

SplFixedArray is a fixed-size array in PHP, suitable for scenarios where high performance and low memory usage are required. 1) It needs to specify the size when creating to avoid the overhead caused by dynamic adjustment. 2) Based on C language array, directly operates memory and fast access speed. 3) Suitable for large-scale data processing and memory-sensitive environments, but it needs to be used with caution because its size is fixed.

How does PHP handle file uploads securely?Apr 10, 2025 am 09:37 AM

PHP handles file uploads through the $\_FILES variable. The methods to ensure security include: 1. Check upload errors, 2. Verify file type and size, 3. Prevent file overwriting, 4. Move files to a permanent storage location.

What is the Null Coalescing Operator (??) and Null Coalescing Assignment Operator (??=)?Apr 10, 2025 am 09:33 AM

In JavaScript, you can use NullCoalescingOperator(??) and NullCoalescingAssignmentOperator(??=). 1.??Returns the first non-null or non-undefined operand. 2.??= Assign the variable to the value of the right operand, but only if the variable is null or undefined. These operators simplify code logic, improve readability and performance.

See all articles

Hot AI Tools

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress images for free

Clothoff.io

AI clothes remover

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)

3 weeks agoBy尊渡假赌尊渡假赌尊渡假赌

R.E.P.O. Best Graphic Settings

3 weeks agoBy尊渡假赌尊渡假赌尊渡假赌

Assassin's Creed Shadows: Seashell Riddle Solution

2 weeks agoByDDD

R.E.P.O. How to Fix Audio if You Can't Hear Anyone

3 weeks agoBy尊渡假赌尊渡假赌尊渡假赌

WWE 2K25: How To Unlock Everything In MyRise

3 weeks agoBy尊渡假赌尊渡假赌尊渡假赌

Hot Tools

DVWA

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is very vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, to help web developers better understand the process of securing web applications, and to help teachers/students teach/learn in a classroom environment Web application security. The goal of DVWA is to practice some of the most common web vulnerabilities through a simple and straightforward interface, with varying degrees of difficulty. Please note that this software