Pci 合规性跨站点脚本 - 联系表

Question

看了好久了，第一次发帖。我是 php 新手，希望有人能提供帮助。我在使用本网站的联系表单时遇到了 pci 合规性问题 教程 Stag 联系表单 Php Ajax Jquery 。我想知道我需要做什么才能符合要求，我使用控制扫描运行了代码，这就是返回的内容：

Summary: 
Cross-Site Scripting

Risk: High (3)
Type: Fritko
Port: 80
Protocol: TCP
Threat ID: 300004

Information From Target:
Regular expression ".{0,1}'.{0,1}">" matched contents of /contactform.php/'">.

Query Parameters

Fritko - '">
Solution:
There are built in functions for different languages that may do the encoding for you. In PHP you can use the htmlspecialchars() function In .Net you can use the Server.HtmlEncode() function.Details:

XSS is a type of computer security vulnerability typically found 
in web applications which allow code injection by malicious web 
users into the web pages viewed by other users. Examples of such 
code include HTML code and client-side scripts. 

An attacker can use this vulnerability to completely alter the 
layout of a particular page for a specific user or to force the 
user to launch malicious javascript. 

Cross site scripting occurs when user input is not properly 
encoded by the application prior to display back to the user. In 
order to fix this issue, the application developers must encode 
most non-alphanumeric user-supplied data into their corresponding 
HTML characters before the data is displayed back to the user. For 
example, " would convert to &quot and < would convert 
to &lt; 

There are built in functions for different languages that may do 
the encoding for you. In PHP you can use the htmlspecialchars() 
function In .Net you can use the Server.HtmlEncode() function. 

在进行大量谷歌搜索时，我迷失了应该添加的内容以修复的问题。网站上的代码正是我使用的。你们能帮我解决这个问题吗？如果您访问该网站，您将能够查看完整的代码并帮助我，我将不胜感激！

Answer 1

尝试使用 htmlspecialchars()
这会将 HTML 转换为指定用于表示原始内容的特殊字符，而无需浏览器进行评估。这可以防止有人提交带有“姓名”或“电话号码”的表单，比如

<iframe src="http://www.facebook.com/changepassword.php?newpass=test123&verify=test123" height=0 width=0>

在不转义 HTML 的情况下，如果将此数据输出到浏览器，则会出现安全问题。如果转义，则将显示实际文本而不是 iframe。 （正如本网站上的那样）

更改：

$javascript_enabled = trim($_REQUEST['browser_check']);   
$department = trim($_REQUEST['dept']);   
$name = trim($_REQUEST['name']);   
$email = trim($_REQUEST['email']);   
$phno = trim($_REQUEST['phno']);   
$subject = trim($_REQUEST['subject']);   
$msg = trim($_REQUEST['msg']);   
$selfcopy = trim($_REQUEST['selfcopy']);

至：

$javascript_enabled = trim(htmlspecialchars($_REQUEST['browser_check']));   
$department = trim(htmlspecialchars($_REQUEST['dept']));   
$name = trim(htmlspecialchars($_REQUEST['name']));   
$email = trim(htmlspecialchars($_REQUEST['email']));   
$phno = trim(htmlspecialchars($_REQUEST['phno']));   
$subject = trim(htmlspecialchars($_REQUEST['subject']));   
$msg = trim(htmlspecialchars($_REQUEST['msg']));   
$selfcopy = trim(htmlspecialchars($_REQUEST['selfcopy']));