{"id":1037,"date":"2010-12-31T09:19:18","date_gmt":"2010-12-31T09:19:18","guid":{"rendered":"http:\/\/www.phpmind.com\/blog\/?p=1037"},"modified":"2010-12-31T09:20:47","modified_gmt":"2010-12-31T09:20:47","slug":"how-to-prevent-xss-attacks-through-php","status":"publish","type":"post","link":"https:\/\/www.phpmind.com\/blog\/2010\/12\/how-to-prevent-xss-attacks-through-php\/","title":{"rendered":"How to prevent XSS attacks through php?"},"content":{"rendered":"<p>There are a number of ways hackers put to use for XSS attacks, PHP&#8217;s built-in functions do not respond to all sorts of XSS attacks. Hence, functions such as strip_tags, filter_var, mysql_real_escape_string, htmlentities, htmlspecialchars, etc do not protect us 100%. You need a better mechanism, here is what is solution:<\/p>\n<pre lang=\"php\">\r\n<?php \r\nfunction xss_clean($data)\r\n{\r\n\/\/ Fix &#038;entity\\n;\r\n$data = str_replace(array('&amp;','&lt;','&gt;'), array('&amp;amp;','&amp;lt;','&amp;gt;'), $data);\r\n$data = preg_replace('\/(&#038;#*\\w+)[\\x00-\\x20]+;\/u', '$1;', $data);\r\n$data = preg_replace('\/(&#038;#x*[0-9A-F]+);*\/iu', '$1;', $data);\r\n$data = html_entity_decode($data, ENT_COMPAT, 'UTF-8');\r\n\r\n\/\/ Remove any attribute starting with \"on\" or xmlns\r\n$data = preg_replace('#(<[^>]+?[\\x00-\\x20\"\\'])(?:on|xmlns)[^>]*+>#iu', '$1>', $data);\r\n\r\n\/\/ Remove javascript: and vbscript: protocols\r\n$data = preg_replace('#([a-z]*)[\\x00-\\x20]*=[\\x00-\\x20]*([`\\'\"]*)[\\x00-\\x20]*j[\\x00-\\x20]*a[\\x00-\\x20]*v[\\x00-\\x20]*a[\\x00-\\x20]*s[\\x00-\\x20]*c[\\x00-\\x20]*r[\\x00-\\x20]*i[\\x00-\\x20]*p[\\x00-\\x20]*t[\\x00-\\x20]*:#iu', '$1=$2nojavascript...', $data);\r\n$data = preg_replace('#([a-z]*)[\\x00-\\x20]*=([\\'\"]*)[\\x00-\\x20]*v[\\x00-\\x20]*b[\\x00-\\x20]*s[\\x00-\\x20]*c[\\x00-\\x20]*r[\\x00-\\x20]*i[\\x00-\\x20]*p[\\x00-\\x20]*t[\\x00-\\x20]*:#iu', '$1=$2novbscript...', $data);\r\n$data = preg_replace('#([a-z]*)[\\x00-\\x20]*=([\\'\"]*)[\\x00-\\x20]*-moz-binding[\\x00-\\x20]*:#u', '$1=$2nomozbinding...', $data);\r\n\r\n\/\/ Only works in IE: <span style=\"width: expression(alert('Ping!'));\"><\/span>\r\n$data = preg_replace('#(<[^>]+?)style[\\x00-\\x20]*=[\\x00-\\x20]*[`\\'\"]*.*?expression[\\x00-\\x20]*\\([^>]*+>#i', '$1>', $data);\r\n$data = preg_replace('#(<[^>]+?)style[\\x00-\\x20]*=[\\x00-\\x20]*[`\\'\"]*.*?behaviour[\\x00-\\x20]*\\([^>]*+>#i', '$1>', $data);\r\n$data = preg_replace('#(<[^>]+?)style[\\x00-\\x20]*=[\\x00-\\x20]*[`\\'\"]*.*?s[\\x00-\\x20]*c[\\x00-\\x20]*r[\\x00-\\x20]*i[\\x00-\\x20]*p[\\x00-\\x20]*t[\\x00-\\x20]*:*[^>]*+>#iu', '$1>', $data);\r\n\r\n\/\/ Remove namespaced elements (we do not need them)\r\n$data = preg_replace('#<\/*\\w+:\\w[^>]*+>#i', '', $data);\r\n\r\ndo\r\n{\r\n        \/\/ Remove really unwanted tags\r\n        $old_data = $data;\r\n        $data = preg_replace('#<\/*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $data);\r\n}\r\nwhile ($old_data !== $data);\r\n\r\n\/\/ we are done...\r\nreturn $data;\r\n}\r\n?>\r\n\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>There are a number of ways hackers put to use for XSS attacks, PHP&#8217;s built-in functions do not respond to all sorts of XSS attacks. Hence, functions such as strip_tags, filter_var, mysql_real_escape_string, htmlentities, htmlspecialchars, etc do not protect us 100%. You need a better mechanism, here is what is solution:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1037","post","type-post","status-publish","format-standard","hentry","category-php"],"_links":{"self":[{"href":"https:\/\/www.phpmind.com\/blog\/wp-json\/wp\/v2\/posts\/1037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.phpmind.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phpmind.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phpmind.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phpmind.com\/blog\/wp-json\/wp\/v2\/comments?post=1037"}],"version-history":[{"count":2,"href":"https:\/\/www.phpmind.com\/blog\/wp-json\/wp\/v2\/posts\/1037\/revisions"}],"predecessor-version":[{"id":1039,"href":"https:\/\/www.phpmind.com\/blog\/wp-json\/wp\/v2\/posts\/1037\/revisions\/1039"}],"wp:attachment":[{"href":"https:\/\/www.phpmind.com\/blog\/wp-json\/wp\/v2\/media?parent=1037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phpmind.com\/blog\/wp-json\/wp\/v2\/categories?post=1037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phpmind.com\/blog\/wp-json\/wp\/v2\/tags?post=1037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}