确保联系表的安全
我有一个客户，他的网站是我用 Wordpress 创建的。它有一个使用联系表单 7 创建的联系表单。该客户是一个较大组织的子公司，该组织的 IT 部门对其子域运行扫描。他们要求我的客户保护联系表 7 免受恶意脚本的侵害或将其删除。
当我询问他们测试的示例时，我的客户告诉我他们运行测试以查看是否可以将脚本插入到输入中（即： ）。
使用查询字符串，联系表单将操作设置为：action="/?scriptalert('hello');/script#wpcf7-f1-p6-o1"。我的第一个问题是，自从“<”以来这会造成任何伤害吗？和“>”已从字符串中删除？
如果是这样，我可以添加什么来消除在此联系表单中运行脚本的可能性吗？
I have a client whose website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their subdomains. The asked my client to protect Contact Form 7 from malicious scripts or take it down.
When I asked for an example of what they tested, my client informed me that they run tests to see if a script could be inserted into a input (ie: <script>alert('hello');</script>) field or as a url string (ie: www.mydomain.com/contact?<script>alert('hello');</script>).
With the query string, the contact form sets the action to: action="/?scriptalert('hello');/script#wpcf7-f1-p6-o1". My first question would be, will this harm anything since the "<" and ">" has been removed from the string?
If so, is there anything I can add to remove the possibility of running scripts in this contact form?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
HTML 编码是防止任何 HTML/JS 生效的一种方法。在页面中显示之前，最好对用户提供的任何值进行编码。
请参阅 https://www.php.net/manual/en/function.htmlentities .php
HTML Encoding is one way to prevent any HTML/JS from taking effect. It's a good idea to encode any user-supplied value before displaying it in the page.
See https://www.php.net/manual/en/function.htmlentities.php