Home  >  Article  >  Operation and Maintenance  >  What are the xss defense measures?

What are the xss defense measures?

王林
王林Original
2020-06-28 16:57:3510763browse

xss defense measures: 1. Do not insert untrusted data in allowed locations; 2. Decode HTML before inserting untrusted data into HTML element content; 3. Before inserting untrusted data into common HTML attributes Attribute decoding; 4. URL decoding before inserting untrusted data into HTML URL attributes.

What are the xss defense measures?

#XSS refers to the use of website vulnerabilities to maliciously steal information from users.

xss defense measures

The following rules are designed to prevent all XSS attacks that occur in applications. Although these rules do not allow arbitrary placing of untrusted data into HTML documents, But it basically covers most common situations.

1. Do not insert untrusted data in allowed locations.

2. Decode HTML before inserting untrusted data into HTML element content.

3. Decode attributes before inserting untrusted data into common HTML attributes.

4. Perform JavaScript decoding before inserting untrusted data into HTML JavaScript Data Values.

5. Perform CSS decoding before inserting untrusted data into HTML style attribute values.

6. Before inserting untrusted data into the HTML URL attribute, perform URL decoding.

The above is the detailed content of What are the xss defense measures?. For more information, please follow other related articles on the PHP Chinese website!

Statement:
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn