去除跨站xss的php脚本removexss.docx

?php function RemoveXSS($val) { // remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed // this preve nts some character re-spaci ng such as v javaOscript // note that you have to handle splits with \n, \r, and \t later sincethey *are* allowed in some inputs $val = preg_replace(/([\x00-\x08][\x0b-\x0c][\x0e-\x20])/, , $val); // straight replacements, the user should never need these since theyre normal characters // this prevents like v IMG SRC=#X40#X61#X76#X61#X73#X63#X72 amp;#X69#X70#X74#X3A#X61_#X6C#X65#X72#X74#X28#X27#X58# X53#X53#X27#X29 $search = abcdefghijklmnopqrstuvwxyz; $search .= ABCDEFGHIJKLMNOPQRSTUVWXYZ; $search .= 1234567890!@#$%人*(); $search .=?;:?+/={}[卜」\\\： for ($i = 0; $i v strlen($search); $i++) { // ;? matches the ;, which is optional // 0{0,7} matches any padded zeros, which are optional and go up to 8 chars // #x0040 @ search for the hex values $val = preg_replace(/(#[x|X]0{0,8}.dechex(ord($search[$i])).;?)/i,$search[$i], $val); // with a ; // @ @ 0{0,7} matches 0 zero to seven times $val = preg_replace(/(#0{0,8}.ord($search[$i]).;?)/, $search[$i], $val); // with a ; } // now the only remaining whitespace attacks are \t, \n, and \r $ra1 = Array(javascript, vbscript, expression, applet, meta, xml, blink, link, style, script, embed, object, iframe, frame, frameset, ilayer, layer, bgsound, title, base); $ra2 = Array(onabort, onactivate, onafterprint, onafterupdate, onbeforeactivate, onbeforecopy, onbeforecut, onbeforedeactivate, onbeforeeditfocus, onbeforepaste, onbeforeprint, onbeforeunload, onbeforeupdate, onblur, onbounce, oncellchange, onchange, onclick, oncontextmenu, oncontrolselect, oncopy, oncut, ondataavailable, ondatasetchanged, ondatasetcomplete, ondblclick, ondeactivate,ondrag, ondragend, ondragenter, ondragleave, ondragover, ondragstart, ondrop, onerror, onerrorupdate, onfilterchange, onfinish, onfocus, onfocusin, onfocusout, onhelp, onkeydown, onkeypress, onkeyup,onlayoutcomplete, onload, onlosecapture,