Preventing server-side scripting, XSS

问题:

Are there any pre-made scripts that I can use for PHP / MySQL to prevent server-side scripting and JS injections?

I know about the typical functions such as htmlentities, special characters, string replace etc. but is there a simple bit of code or a function that is a failsafe for everything?

Any ideas would be great. Many thanks :)

EDIT: Something generic that strips out anything that could be hazardous, ie. greater than / less than signs, semi-colons, words like "DROP", etc?

I basically just want to compress everything to be alphanumeric, I guess...?

回答1:

Never output any bit of data whatsoever to the HTML stream that has not been passed through htmlspecialchars() and you're done. Simple rule, easy to follow, completely eradicates any XSS risk.

As a programmer it's your job to do it, though.

You can define

function h(s) { return htmlspecialchars(s); }

if htmlspecialchars() is too long to write 100 times per PHP file. On the other hand, using htmlentities() is not necessary at all.

---

The key point is: There is code, and there is data. If you intermix the two, bad things ensue.

In the case of HTML, code is elements, attribute names, entities, comments. Data is everything else. Data must be escaped to avoid being mistaken for code.

In case of URLs, code is the scheme, the host name, the path, the mechanism of the query string (?, &, =, #). Data is everything in the query string: parameter names and values. They must be escaped to avoid being mistaken for code.

URLs embedded in HTML must be doubly escaped (by URL-escaping and HTML-escaping) to ensure proper separation of code and data.

Modern browsers are capable of parsing amazingly broken and incorrect markup into something useful. This capability should not be stressed, though. The fact that something happens to work (like URLs in <a href> without proper HTML-escaping applied) does not mean that it's good or correct to do it. XSS is a problem that roots in a) people unaware of data/code separation (i.e. "escaping") or those that are sloppy and b) people that try to be clever about what part of data they don't need to escape.

XSS is easy enough to avoid if you make sure you don't fall into categories a) and b).

回答2:

I think Google-caja maybe a solution. I write a taint analyzer for java web application to detect and prevent XSS automatically. But not for PHP. I think Learning to using caja not bad for web developer.

回答3:

No, there isn't. Risks depend on what you do with data, you can't write something that makes data safe for everything (unless you want to discard most of the data)

回答4:

is there a simple bit of code or a function that is a failsafe for everything?

No.

The representation of data leaving PHP must be converted / encoded specifically according where it is going. And therefore should only be converted/encoded at the point where it leaves PHP.

C.

回答5:

You can refer to OWASP to get more understanding of XSS attacks:

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

To avoid js attacks, you can try this project provided by open source excellence:

https://www.opensource-excellence.com/shop/ose-security-suite.html

my website had the js attacks before, and this tool helps me block all attacks everyday. i think it can help you guys to avoid the problem.

Further, you can add a filter in your php script to filter all js attacks, here is one pattern that can do job:

if (preg_match('/(?:[".]script\s*()|(?:\$\$?\s*(\s*[\w"])|(?:/[\w\s]+/.)|(?:=\s*/\w+/\s*.)|(?:(?:this|window|top|parent|frames|self|content)[\s*[(,"]\s[\w\$])|(?:,\s*new\s+\w+\s*[,;)/ms', strtolower($POST['VARIABLENAME']))) { filter_variable($POST['VARIABLENAME']); }

回答6:

To answer to your edition: everything except <> symbols has nothing to do with XSS.
And htmlspecialchars() can deal with them.

There is no harm in the word DROP table in the page's text ;)

回答7:

for clean user data use html_special_chars(); str_replace() and other funcs to cut unsafe data.