用于表单验证的 ReqEx 表达式
我正在尝试向我的 html 网站添加表单验证，以防止 xss 注入攻击。
我正在使用一个简单的 java 表单验证器 genvalidator_v4.js，它允许我使用正则表达式来确定文本框中允许的内容。我正在尝试写一个可以防止“<”或“>”或任何其他可用于此类攻击的标签，但仍允许字母数字、标点符号和其他特殊字符。
有什么想法吗？也欢迎其他防止 xss 攻击的方法，但我在这方面非常缺乏经验，所以请尽可能简单。
I am trying to add form validation to my html site in order to prevent xss injection attacks.
I am using a simple java form validator genvalidator_v4.js that allows me to use regex expressions to determine what is allowed in a text box. I am trying to write one that would prevent "<" or ">" or any other tags that could be used in this kind of attack, but still allow alphanumeric, punctuation, and other special characters.
Any ideas? Also open to other methods of preventing xss attacks but I am very inexperienced in this area so please keep it as simple as possible.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您正在尝试将危险输入列入黑名单。这非常棘手，很容易出错，因为令牌数量太多可能是危险的。
因此，建议采用以下两种做法：
转义从数据库读取的所有内容在输出到网页上之前。如果您正确地对所有内容进行了 HtmlEncode（您选择的语言肯定有相应的库方法），那么如果用户输入
如果您仍然想过滤输入（这可能作为附加安全层有用），白名单通常比黑名单更安全。因此，不要说
<有害，而是说字母、数字、标点符号等是安全的。到底什么是安全的取决于您要过滤的字段类型。You are trying to blacklist dangerous input. That's very tricky, it's very easy to get it wrong because of the sheer number of tokens that could be dangerous.
Thus, the following two practices are recommended instead:
Escape everything read from the database before outputting it on a web page. If you correctly HtmlEncode everything (your language of choice surely has a library method for that), it doesn't matter if a user entered
<script>/* do something evil */</script>and that code got stored in your database. Correctly encoded, this will just be printed verbatim and do no harm.If you still want to filter input (which might be useful as an additional layer of security), whitelists are generally safer than blacklists. So, instead of saying that
<is harmful, you say that letters, digits, punctuation, etc. are safe. What exactly is safe depends on what type of field you are filtering.