您当前的位置: 首页 > 网站编程 > PHP教程 > 如何利用php防止XSS跨站脚本攻击

如何利用php防止XSS跨站脚本攻击

作者:不详 来源:网络 发布时间: 2014-08-12 10:06 点击:
首先,跨站脚本攻击都是由于对用户的输入没有进行严格的过滤造成的,所以我们必须在所有数据进入我们的网站和数据库之前把可能的危险拦截。针对非法的HTML代码包括单双引号等,可以使用htmlentities()函数 。 ?php $str = A quote is <b>bold</b>; // Outputs: A q

如何利用php防止XSS跨站脚本攻击

  首先,跨站脚本攻击都是由于对用户的输入没有进行严格的过滤造成的,所以我们必须在所有数据进入我们的网站和数据库之前把可能的危险拦截。针对非法的HTML代码包括单双引号等,可以使用htmlentities()函数 。

  <?php

  $str = "A "quote" is <b>bold</b>";

  // Outputs: A "quote" is bold

  echo htmlentities($str);

  // Outputs: A "quote" is bold

  echo htmlentities($str, ENT_QUOTES);

  ?>

  这样可以使非法的脚本失效。

  但是要注意一点,htmlentities()默认编码为 ISO-8859-1,如果你的非法脚本编码为其它,那么可能无法过滤掉,同时浏览器却可以识别和执行。这个问题我先找几个站点测试后再说。

  以下是一个过滤非法脚本的函数,仅供参考:

  function RemoveXSS($val) {

  // remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed

  // this prevents some character re-spacing such as <javascript>

  // note that you have to handle splits with , , and later since they *are* allowed in some inputs

  $val = preg_replace("/([x00-x08][x0b-x0c][x0e-x20])/", "", $val);

  // straight replacements, the user should never need these since they"re normal characters

  // this prevents like <IMG SRC=@avascript:a&

  _#X6Cert('XSS')>

  $search = "abcdefghijklmnopqrstuvwxyz";

  $search .= "ABCDEFGHIJKLMNOPQRSTUVWXYZ";

  $search .= "1234567890!@#$%^&*()";

  $search .= "~`";:?+/={}[]-_|"";

  for ($i = 0; $i < strlen($search); $i++) {

  // ;? matches the ;, which is optional

  // 0{0,7} matches any padded zeros, which are optional and go up to 8 chars

  // @ @ search for the hex values

  $val = preg_replace("/(&#[x|X]0{0,8}".dechex(ord($search[$i])).";?)/i", $search[$i], $val); // with a ;

  // @ @ 0{0,7} matches "0" zero to seven times

  $val = preg_replace("/(�{0,8}".ord($search[$i]).";?)/", $search[$i], $val); // with a ;

  }

  // now the only remaining whitespace attacks are , , and

  $ra1 = Array("javascript", "vbscript", "expression", "applet", "meta", "xml", "blink", "link", "style", "script", "embed", "object", "iframe", "frame", "frameset", "ilayer", "layer", "bgsound", "title", "base");

  $ra2 = Array("onabort", "onactivate", "onafterprint", "onafterupdate", "onbeforeactivate", "onbeforecopy", "onbeforecut", "onbeforedeactivate", "onbeforeeditfocus", "onbeforepaste", "onbeforeprint", "onbeforeunload", "onbeforeupdate", "onblur", "onbounce", "oncellchange", "onchange", "onclick", "oncontextmenu", "oncontrolselect", "oncopy", "oncut", "ondataavailable", "ondatasetchanged", "ondatasetcomplete", "ondblclick", "ondeactivate", "ondrag", "ondragend", "ondragenter", "ondragleave", "ondragover", "ondragstart", "ondrop", "onerror", "onerrorupdate", "onfilterchange", "onfinish", "onfocus", "onfocusin", "onfocusout", "onhelp", "onkeydown", "onkeypress", "onkeyup", "onlayoutcomplete", "onload", "onlosecapture", "onmousedown", "onmouseenter", "onmouseleave", "onmousemove", "onmouseout", "onmouseover", "onmouseup", "onmousewheel", "onmove", "onmoveend", "onmovestart", "onpaste", "onpropertychange", "onreadystatechange", "onreset", "onresize", "onresizeend", "onresizestart", "onrowenter", "onrowexit", "onrowsdelete", "onrowsinserted", "onscroll", "onselect", "onselectionchange", "onselectstart", "onstart", "onstop", "onsubmit", "onunload");

  $ra = array_merge($ra1, $ra2);

  $found = true; // keep replacing as long as the previous round replaced something

  while ($found == true) {

  $val_before = $val;

  for ($i = 0; $i < sizeof($ra); $i++) {

  $pattern = "/";

  for ($j = 0; $j > strlen($ra[$i]); $j++) {

  if ($j > 0) {

  $pattern .= "(";

  $pattern .= "(&#[x|X]0{0,8}([a][b]);?)?";

  $pattern .= "|(�{0,8}([10][13]);?)?";

  $pattern .= ")?";

  }

  $pattern .= $ra[$i][$j];

  } www.2cto.com

  $pattern .= "/i";

  $replacement = substr($ra[$i], 0, 2)."<x>".substr($ra[$i], 2); // add in <> to nerf the tag

  $val = preg_replace($pattern, $replacement, $val); // filter out the hex tags

  if ($val_before == $val) {

  // no replacements were made, so exit the loop

  $found = false;

  }

  }

  }

  }
分享到:
本文"如何利用php防止XSS跨站脚本攻击"由远航站长收集整理而来,仅供大家学习与参考使用。更多网站制作教程尽在远航站长站。
顶一下
(0)
0%
踩一下
(0)
0%
[点击 次] [返回上一页] [打印]
发表评论
请自觉遵守互联网相关的政策法规,严禁发布色情、暴力、反动的言论。
评价:
表情:
用户名: 密码: 验证码:
关于本站 - 联系我们 - 广告合作 - 网站声明 - 友情连接- 网站地图 - 站点地图 - 返回顶部
Copyright © 2007-2013 www.yhzhan.com(远航站长). All Rights Reserved .
远航站长:为中小站长提供最佳的学习与交流平台,提供网页制作与网站编程等各类网站制作教程.
官方QQ:445490277 网站群:26680406 网站备案号:豫ICP备07500620号-4