XSS URL过滤
我正在使用我制作的这个函数，尽管可能不是原创的，并且想知道这是否有利于过滤基于 url 的 XSS 攻击。就是这里
function clean($url) {
return strip_tags(html_entity_decode(urldecode($url), null, 'UTF-8'), ENT_QUOTES);
}
如果不是一个正确方向的点就好了
I am using this function I made, although probably not original, and was wondering if this is good for filtering url based XSS attacks. here it is
function clean($url) {
return strip_tags(html_entity_decode(urldecode($url), null, 'UTF-8'), ENT_QUOTES);
}
If not a point in the right direction would be nice
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我建议你选择一个著名的框架（稳定），例如 Codeigniter、Kohana、Yii、Zend 并浏览其源代码。它们中的大多数都提供了您可以调整的辅助函数。通过这种方式，您可以受益于使用“社区编辑”的内容，这些内容始终与大多数安全威胁保持同步。
I suggest you pick a famous framework (stable) such as Codeigniter, Kohana, Yii, Zend and browse it's source code. Most of them provide such helper functions which you can adapt. This way you have the benefit of using something "community edited" which is always up to date with most of the security threats out there.
我建议查看 OWASP 的 ESAPI 项目。他们创建了一个编码库，支持多种语言，包括 Java、.NET、PHP、Classic ASP、Cold Fusion、Python 和 Haskell。 的上下文中的不受信任数据进行编码的工具：
它还可以满足输入验证的需要
使用 ESAPI 的一些组织包括 American Express、Apache Foundation、Booz Allen Hamilton、Aspect Security、Foundstone(McAfee)、The Hartford、Infinite Campus、Lockheed Martin、MITRE、美国海军 - SPAWAR、世界银行、SANS Institute。
我还建议阅读他们的 XSS 预防备忘单，其中描述了最好的方法构建 XSS 防御的实践（本质上归结为您必须对要放入不可信数据的 HTML 文档部分使用转义语法）。
I would suggest looking at OWASP's ESAPI Project. They have created an encoding library which comes in a variety of languages including Java, .NET, PHP, Classic ASP, Cold Fusion, Python, and Haskell. It has tools for encoding untrusted data for the context that you're dealing with:
It also caters for input validation.
Some organisations using ESAPI include American Express, Apache Foundation, Booz Allen Hamilton, Aspect Security, Foundstone(McAfee), The Hartford, Infinite Campus, Lockheed Martin, MITRE, U.S. Navy - SPAWAR, The World Bank, SANS Institute.
I also recommend giving their XSS Prevention Cheat Sheet a read which describes the best practices in building your defenses against XSS (it essentially boils down to that you MUST use the escape syntax for the part of the HTML document you’re putting untrusted data into).