最近做的项目被测试测出了存在存储型XSS,至此记录一下,问题出在了 input 框 :payload:"a" οnclick=alert(1)>
也做了一些XSS过滤,但是不全,有从网上找了一些,弄了一个简单粗暴的
后台接收 input 框字符串内容,存在被攻击,便整理了一个比较粗暴的方法
//过滤存储型XSS攻击
//过滤存储型XSS攻击
public function safe_filter(&$string)
{
$ra=Array('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/','/script/','/javascript/','/vbscript/','/expression/','/applet/','/meta/','/xml/','/blink/','/link/','/style/','/embed/','/object/','/frame/','/layer/','/title/','/bgsound/','/base/','/onload/','/onunload/','/onchange/','/onsubmit/','/onreset/','/onselect/','/onblur/','/onfocus/','/onabort/','/onkeydown/','/onkeypress/','/onkeyup/','/onclick/','/ondblclick/','/onmousedown/','/onmousemove/','/onmouseout/','/onmouseover/','/onmouseup/','/onunload/');
$data=str_replace(array('&','<','>'),array('&','<','>'),$data);
if (!get_mag