利用PHP编程防范XSS跨站脚本攻击
作者 佚名技术
来源 NET编程
浏览
发布时间 2012-05-23
| ''oncellchange'', ''onchange'', ''onclick'', ''oncontextmenu'', ''oncontrolselect'', ''oncopy'', ''oncut'', ''ondataavailable'', ''ondatasetchanged'', ''ondatasetcomplete'', ''ondblclick'', ''ondeactivate'', ''ondrag'', ''ondragend'', ''ondragenter'', ''ondragleave'', ''ondragover'', ''ondragstart'', ''ondrop'', ''onerror'', ''onerrorupdate'', ''onfilterchange'', ''onfinish'', ''onfocus'', ''onfocusin'', ''onfocusout'', ''onhelp'', ''onkeydown'', ''onkeypress'', ''onkeyup'', ''onlayoutcomplete'', ''onload'', ''onlosecapture'', ''onmousedown'', ''onmouseenter'', ''onmouseleave'', ''onmousemove'', ''onmouseout'', ''onmouseover'', ''onmouseup'', ''onmousewheel'', ''onmove'', ''onmoveend'', ''onmovestart'', ''onpaste'', ''onpropertychange'', ''onreadystatechange'', ''onreset'', ''onresize'', ''onresizeend'', ''onresizestart'', ''onrowenter'', ''onrowexit'', ''onrowsdelete'', ''onrowsinserted'', ''onscroll'', ''onselect'', ''onselectionchange'', ''onselectstart'', ''onstart'', ''onstop'', ''onsubmit'', ''onunload''); $ra = array_merge($ra1, $ra2); $found = true; // keep replacing as long as the previous round replaced something while ($found == true) { $val_before = $val; for ($i = 0; $i ＜ sizeof($ra); $i++) { $pattern = ''/''; for ($j = 0; $j ＜ strlen($ra[$i]); $j++) { if ($j ＞ 0) { $pattern .= ''(''; $pattern .= ''(&#[x|X]0{0,8}([9][a][b]);?)?''; $pattern .= ''|(�{0,8}([9][10][13]);?)?''; $pattern .= '')?''; } $pattern .= $ra[$i][$j]; } $pattern .= ''/i''; $replacement = substr($ra[$i], 0, 2).''＜x＞''.substr($ra[$i], 2); // add in ＜＞ to nerf the tag $val = preg_replace($pattern, $replacement, $val); // filter out the hex tags if ($val_before == $val) { // no replacements were made, so exit the loop $found = false; } } } } |
凌众科技专业提供服务器租用、服务器托管、企业邮局、虚拟主机等服务，公司网站：http://www.lingzhong.cn 为了给广大客户了解更多的技术信息，本技术文章收集来源于网络,凌众科技尊重文章作者的版权，如果有涉及你的版权有必要删除你的文章，请和我们联系。以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢! |
你可能对下面的文章感兴趣
关于利用PHP编程防范XSS跨站脚本攻击的所有评论
