XSS又叫CSS (Cross Site Script) ，跨站脚本攻击。它指的是恶意攻击者往Web页面里插入恶意html代码，当用户浏览该页之时，嵌入其中Web里面的html代码会被执行，进而达到某些人的攻击目的。
下面是thinkphp里面的一段代码，用于过滤xss
ThinkPHP\Code\ThinkPHP\Common\extend.php
<?php /** * @去除XSS（跨站脚本攻击）的函数 * @par $val 字符串参数，可能包含恶意的脚本代码如<script language="javascript">alert("hello world"); * @return 处理后的字符串 * @Recoded By Androidyue **/ function RemoveXSS($val) { // remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed // this prevents some character re-spacing such as <java> // note that you have to handle splits with \n, \r, and \t later since they *are* allowed in some inputs $val = preg_replace('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/', '', $val); // straight replacements, the user should never need these since they're normal characters // this prevents like <img src="@avascript:alert('XSS')" alt="php xss过滤" > $search = 'abcdefghijklmnopqrstuvwxyz'; $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'; $search .= '1234567890!@#$%^&*()'; $search .= '~`";:?+/={}[]-_|\'\\'; for ($i = 0; $i 0) { $pattern .= '('; $pattern .= '([xX]0{0,8}([9ab]);)'; $pattern .= '|'; $pattern .= '|(?{0,8}([9|10|13]);)'; $pattern .= ')*'; } $pattern .= $ra[$i][$j]; } $pattern .= '/i'; $replacement = substr($ra[$i], 0, 2).'<x>'.substr($ra[$i], 2); // add in to nerf the tag $val = preg_replace($pattern, $replacement, $val); // filter out the hex tags if ($val_before == $val) { // no replacements were made, so exit the loop $found = false; } } } return $val; } //测试一下效果 //echo RemoveXSS("<script language="javascript">alert('hello world');</script>") ; ?> </x></java>
