XSS攻击过滤函数

黑客用XSS攻击有多种方式,PHP的内置函数不能应对各种各样的XSS攻击。因此,使用filter_var,mysql_real_escape_string,htmlentities,htmlspecialchars,strip_tags等功能也不能做到100%的防护。你需要一个更好的机制,这是你的解决方案：

<?php
function xss_clean($data)
{
// Fix &entityn;
$data = str_replace(array(&amp;,&lt;,&gt;), array(&amp;amp;,&amp;lt;,&amp;gt;), $data);
$data = preg_replace(/(&#*w+)[x00-x20]+;/u, $1;, $data);
$data = preg_replace(/(&#x*[0-9A-F]+);*/iu, $1;, $data);
$data = html_entity_decode($data, ENT_COMPAT, UTF-8);

// Remove any attribute starting with "on" or xmlns
$data = preg_replace(#(<[^>]+?[x00-x20"])(?:on|xmlns)[^>]*+>#iu, $1>, $data);

// Remove javascript: and vbscript: protocols
$data = preg_replace(#([a-z]*)[x00-x20]*=[x00-x20]*([`"]*)[x00-x20]*j[x00-x20]*a[x00-x20]*v[x00-x20]*a[x00-x20]*s[x00-x20]*c[x00-x20]*r[x00-x20]*i[x00-x20]*p[x00-x20]*t[x00-x20]*:#iu, $1=$2nojavascript..., $data);
$data = preg_replace(#([a-z]*)[x00-x20]*=(["]*)[x00-x20]*v[x00-x20]*b[x00-x20]*s[x00-x20]*c[x00-x20]*r[x00-x20]*i[x00-x20]*p[x00-x20]*t[x00-x20]*:#iu, $1=$2novbscript..., $data);
$data = preg_replace(#([a-z]*)[x00-x20]*=(["]*)[x00-x20]*-moz-binding[x00-x20]*:#u, $1=$2nomozbinding..., $data);

// Only works in IE: <span style="width: expression(alert(Ping!));"></span>
$data = preg_replace(#(<[^>]+?)style[x00-x20]*=[x00-x20]*[`"]*.*?expression[x00-x20]*([^>]*+>#i, $1>, $data);
$data = preg_replace(#(<[^>]+?)style[x00-x20]*=[x00-x20]*[`"]*.*?behaviour[x00-x20]*([^>]*+>#i, $1>, $data);
$data = preg_replace(#(<[^>]+?)style[x00-x20]*=[x00-x20]*[`"]*.*?s[x00-x20]*c[x00-x20]*r[x00-x20]*i[x00-x20]*p[x00-x20]*t[x00-x20]*:*[^>]*+>#iu, $1>, $data);

// Remove namespaced elements (we do not need them)
$data = preg_replace(#</*w+:w[^>]*+>#i, , $data);
www.2cto.com
do
{
// Remove really unwanted tags
$old_data = $data;
$data = preg_replace(#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i, , $data);
}
while ($old_data !== $data);

// we are done...
return $data;
}
?>