如何保证网站安全检查
如何保护表单免受脚本注入攻击。这是最常用的攻击形式之一，攻击者尝试通过表单字段注入 JS 脚本。这种情况的验证必须检查表单字段中的特殊字符。寻找 在互联网/jquery 等上对允许的字符和字符的建议、推荐 字符屏蔽验证 JS 代码。
How to safe gaurd a form against script injection attacks. This is one of the most used form of attacks in which attacker attempts to inject a JS script through form field. The validation for this case must check for special characters in the form fields. Look for
suggestions, recommedations at internet/jquery etc for permissible characters &
character masking validation JS codes.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
您可以使用HTML Purifier（如果您使用的是 PHP 或者您可能有其他选项）以避免XSS（跨站点脚本）< /a> 攻击达到很高的水平，但请记住没有解决方案是完美的或 100% 可靠的。这应该对您有帮助，并且永远记住服务器端验证始终是最好的，而不是依赖 javascript，坏人可以轻松绕过禁用 javascript。
对于SQL 注入，您需要从以下查询中转义无效字符：可用于操作或注入查询，并对要插入数据库的所有值使用类型转换。
请参阅安全指南了解更多安全风险以及如何避免这些风险。请注意，即使您不使用 PHP，安全性的基本思想也是相同的，这应该可以让您更好地了解安全性考虑因素。
You can use the HTML Purifier (in case you are under PHP or you might have other options for the language you are under) to avoid XSS (cross-site-scripting) attacks to great level but remember no solution is perfect or 100% reliable. This should help you and always remember server-side validation is always best rather than relying on javascript which bad guys can bypass easily disabling javascript.
For SQL Injection, you need to escape invalid characters from queries that can be used to manipulate or inject your queries and use type-casting for all your values that you want to insert into the database.
See the Security Guide for more security risks and how to avoid them. Note that even if you are not using PHP, the basic ideas for the security are same and this should get you in a better position about security considerations.
如果您在 html 上下文中输出用户控制的输入，那么您可以遵循其他人的做法并在处理输入（html 净化、自定义输入验证）时进行清理和/或在输出之前对值进行 html 编码。
htmlencodng/strip 标签（不需要标签）不够的情况：
appears in CSS - css escape is different and css allows javascript (expression)
此外，这些并没有考虑到浏览器缺陷，例如不完整的 UTF-8 序列利用、内容类型嗅探利用（UTF-7 缺陷）等。
当然，您还必须处理数据以防止其他攻击（SQL 或命令注入 ） ）。
If you output user controlled input in html context then you could follow what others and sanitize when processing input (html purify, custom input validation) and/or html encode the values before output.
Cases when htmlencodng/strip tags (no tags needed) is not sufficient:
appears in CSS - css escape is different and css allows javascript (expression)
Also, these do not account for browser flaws such as incomplete UTF-8 sequence exploit, content-type sniffing exploits (UTF-7 flaw), etc.
Of course you also have to treat data to protect against other attacks (SQL or command injection).
最好的参考可能是 OWASP XSS 预防备忘单
Probably the best reference for this is at the OWASP XSS Prevention Cheat Sheet
ASP.NET 有一个名为请求验证的功能，该功能将阻止未编码的 HTML正在由服务器处理。如需额外保护，可以使用 AntiXSS 库。
ASP.NET has a feature called Request Validation that will prevent unencoded HTML from being processed by the server. For extra protection, one can use the AntiXSS library.
您可以通过对 html 内容进行编码来防止脚本注入，例如
Server.HtmlEncode(input)
you can prevent script injection by encoding html content like
Server.HtmlEncode(input)
还有 OWASP EASPI。
There is the OWASP EASPI too.