共有5条评论

1. 飞豆订阅: Jul,17th,2008
   

   你好，欣赏你的博客，觉得你的内容挺不错的
   希望能同贵blog合作，同更多的朋友一起分享您的内容
   感兴趣的话，可以直接跟我联系，
   QQ 120877855

2. keylee: Jul,29th,2008
   

   经常看你写的安全类文章，学习了不少东西，感觉阁下的PHP水平不错，能否用PHP帮我写个过滤自定义CSS（比如校内网那种）危险字符的东西呢？
   QQ:943304722

3. keylee: Jul,29th,2008
   

   给个过滤思路也成，我实在是没有把握

4. oldjun: Jul,29th,2008
   

   function filter($str){
   $file="keywords.txt";
   $fp=fopen($file,"rb");
   $content=fread($fp,filesize($file));
   fclose($fp);
   $keywords = explode("\n",$content);
   foreach($keywords as $keys) {
   $keys = str_replace(array("\n","\r"),"",$keys);
   if(strpos($str,$keys)===false) {
   continue;
   }else {
   $str="Bad words！";
   break;
   }
   }
   return $str;
   }
   很简单的思路，keywords.txt里把所有容易被XSS利用的关键词放进去，此法亦可以进行关键词过滤！

5. oldjun: Jul,29th,2008
   

   找了个国外牛人的代码，学习下吧：
   function RemoveXSS($val) {
   　// remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed
   　// this prevents some character re-spacing such as
   　// note that you have to handle splits with \n, \r, and \t later since they *are* allowed in some inputs
   　$val = preg_replace('/([\x00-\x08][\x0b-\x0c][\x0e-\x20])/', '', $val);
   　// straight replacements, the user should never need these since they're normal characters
   　// this prevents like
   　$search = 'abcdefghijklmnopqrstuvwxyz';
   　$search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
   　$search .= '1234567890!@#$%^&*()';
   　$search .= '~`";:?+/={}[]-_|\'\\';
   　for ($i = 0; $i < strlen($search); $i++) {
   // ;? matches the ;, which is optional
   // 0{0,7} matches any padded zeros, which are optional and go up to 8 chars
   // @ @ search for the hex values
   $val = preg_replace('/(&#[x|X]0{0,8}'.dechex(ord($search[$i])).';?)/i',$search[$i], $val); // with a ;
   // @ @ 0{0,7} matches '0' zero to seven times
   $val = preg_replace('/(�{0,8}'.ord($search[$i]).';?)/', $search[$i],
   $val); // with a ;
   　}
   　// now the only remaining whitespace attacks are \t, \n, and \r
   $ra1 = Array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml',
   'blink', 'link', 'style', 'script', 'embed', 'object', 'iframe', 'frame',
   'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base');
   $ra2 = Array('onabort', 'onactivate', 'onafterprint', 'onafterupdate',
   'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate',
   'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload',
   'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick',
   'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable',
   'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate',
   'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart',
   'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus',
   'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup',
   'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter',
   'onmouseleave', 'onmousemove', 'onmouseout','onmouseover', 'onmouseup',
   'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange',
   'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart',
   'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect',
   'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload');
   　$ra = array_merge($ra1, $ra2);
   　$found = true; // keep replacing as long as the previous round replaced something
   　while ($found == true) {
   $val_before = $val;
   for ($i = 0; $i < sizeof($ra); $i++) {
   　$pattern = '/';
   　for ($j = 0; $j < strlen($ra[$i]); $j++) {
   if ($j > 0) {
   　$pattern .= '(';
   　$pattern .= '(&#[x|X]0{0,8}([9][a][b]);?)?';
   　$pattern .= '|(�{0,8}([9][10][13]);?)?';
   　$pattern .= ')?';
   }
   　$pattern .= $ra[$i][$j];
   }
   $pattern .= '/i';
   $replacement = substr($ra[$i], 0, 2).''.substr($ra[$i], 2); // add in
   to nerf the tag
   $val = preg_replace($pattern, $replacement, $val); // filter out the hex tags
   if ($val_before == $val) {
   　// no replacements were made, so exit the loop
   　$found = false;
   }
   }
   }
   }