PHP 解决XSS和会话重放

XSS:

function safeFilter ($data) 
{
   $ra=Array('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/','/script/','/javascript/','/vbscript/','/expression/','/applet/','/meta/','/xml/','/blink/','/link/','/style/','/embed/','/object/','/frame/','/layer/','/title/','/bgsound/','/base/','/onload/','/onunload/','/onchange/','/onsubmit/','/onreset/','/onselect/','/onblur/','/onfocus/','/onabort/','/onkeydown/','/onkeypress/','/onkeyup/','/onclick/','/ondblclick/','/onmousedown/','/onmousemove/','/onmouseout/','/onmouseover/','/onmouseup/','/onunload/');
    if (!get_magic_quotes_gpc())             //不对magic_quotes_gpc转义过的字符使用addslashes(),避免双重转义。
    {
       $data  = addslashes($data);           //给单引号（'）、双引号（"）、反斜线（\）与 NUL（NULL 字符）加上反斜线转义
    }
    $data       = preg_replace($ra,'屏蔽可疑字符串',$data);     //删除非打印字符，粗暴式过滤xss可疑字符串
    $data     = htmlentities(strip_tags($data)); //去除 HTML 和 PHP 标记并转换为 HTML 实体
    return $data;
}

会话重放：

前端：

<td>
            <?php 
            $x_timestamp = time();
            $x_nonce = rand(0,99999);
            $sign = md5($x_timestamp.$x_nonce.'eastobacco');
        ?>
        <input type="hidden" name="x_timestamp" value="<?php echo $x_timestamp ?>">
        <input type="hidden" name="x_nonce" value="<?php echo $x_nonce ?>">
        <input type="hidden" name="sign" value="<?php echo $sign ?>">
      </td>

后端：

$x_timestamp = $_POST['x_timestamp'];
            $x_nonce = $_POST['x_nonce'];
            $sign = $_POST['sign'];
            if(Yii::app()->memcache->get($x_nonce)){
                echo json_encode(array('code' => -1, 'tip' => '', 'message' => '重复会话'));
                exit;
            }

            if(md5($x_timestamp.$x_nonce.'eastobacco') != $sign){
                echo json_encode(array('code' => -1, 'tip' => '', 'message' => '签名失败'));
                exit;
            }
            if(time()-$x_timestamp > 60){
                echo json_encode(array('code' => -1, 'tip' => '', 'message' => '会话已失效'));
                exit;
            }