php xss过滤

XSS又叫CSS (Cross Site Script) ，跨站脚本攻击。它指的是恶意攻击者往Web页面里插入恶意html代码，当用户浏览该页之时，嵌入其中Web里面的html代码会被执行，进而达到某些人的攻击目的。

下面是thinkphp里面的一段代码，用于过滤xss

ThinkPHP\Code\ThinkPHP\Common\extend.php

    <?php /**     * @去除XSS（跨站脚本攻击）的函数     * @par $val 字符串参数，可能包含恶意的脚本代码如<script language="javascript">alert("hello world");     * @return  处理后的字符串     * @Recoded By Androidyue     **/      function RemoveXSS($val) {           // remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed           // this prevents some character re-spacing such as <java>           // note that you have to handle splits with \n, \r, and \t later since they *are* allowed in some inputs           $val = preg_replace('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/', '', $val);                  // straight replacements, the user should never need these since they're normal characters           // this prevents like <img  src="@avascript:alert('XSS')" alt="php xss过滤" >           $search = 'abcdefghijklmnopqrstuvwxyz';          $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';           $search .= '1234567890!@#$%^&*()';          $search .= '~`";:?+/={}[]-_|\'\\';          for ($i = 0; $i  0) {                      $pattern .= '(';                       $pattern .= '([xX]0{0,8}([9ab]);)';                      $pattern .= '|';                       $pattern .= '|(?{0,8}([9|10|13]);)';                      $pattern .= ')*';                   }                   $pattern .= $ra[$i][$j];                }                $pattern .= '/i';                 $replacement = substr($ra[$i], 0, 2).'<x>'.substr($ra[$i], 2); // add in  to nerf the tag                 $val = preg_replace($pattern, $replacement, $val); // filter out the hex tags                 if ($val_before == $val) {                    // no replacements were made, so exit the loop                    $found = false;                 }              }           }           return $val;        }      //测试一下效果      //echo RemoveXSS("<script language="javascript">alert('hello world');</script>") ;      ?>  </x></java>

此外还有一个工具：HTML Purifier，比上面的文档效率高一倍，欲知后事如何，且听下回分解。