轻松防止 XSS 或 javascript 相关攻击
我已阻止在服务器端 php 验证上提交“脚本”一词，并使用 htmlentities 和 strip 函数。这会保护所有与 javascript 相关的攻击吗？
I have prevented the word 'script' from submission on my server side php validation and used htmlentities and strip function. Will this safeguard all javascript related attack ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不，有很多攻击媒介，因为 javascript 和标记是解释的，浏览器喜欢自动修复用户的拼写错误，并且某些浏览器对 css 中的 javascript 具有不安全的专有支持等。您可以阻止“script”，但“sc ript”呢？ （是的，有些浏览器会修复它）或“脚本”？当您的简单验证器删除一个脚本时，它实际上会留下另一个脚本。它需要递归。还有 onload、onblur、onmove 等呢？还有很多更晦涩难懂的黑客：
http://ha.ckers.org/xss.html
此外，只需能够获得链接或更糟糕的是，图像标签将允许用户让您的客户端和页面上的其他人发出任意 GET 请求，包括模仿管理表单（如果您错误地在输入中同时允许 GET 和 POST） - 您认为 Facebook 为何会重写所有内容发布了通过他们的代理的链接 第一的。
对于一个人来说，要独自追踪这一点实在是太困难了。您应该研究一个像这样的开源库，人们在其中共同开发解决方案，并在发现新的漏洞时进行更新：
http://htmlpurifier.org/ (php)
我确信其他语言也有等效的。
No, there are so many attack vectors because javascript and markup is interpreted, browsers like to fix user's typos automatically, and some browsers have unsafe proprietary support for javascript in css, etc. you can block "script" but what about "sc ript" (yes some browsers will fix it) or "scrscriptipt"? When your simple validator removes one script it will actually leave another. It needs to be recursive. Also what about onload, onblur, onmove etc? There are so many more obscure hacks:
http://ha.ckers.org/xss.html
Additionally, simply being able to get a link or worse an image tag in will allow the user to make your client and others on the page make any arbitrary GET requests including mimicking admin forms (if you incorrectly allow both GET and POST in your inputs) - why do you think Facebook rewrites all posted links to go through their proxy first.
It's too much for one man to keep track of on his own. You should look into an open source lib like this one where people work together on a solution and update when new exploits are found:
http://htmlpurifier.org/ (php)
I'm sure other languages have an equivalent.