php安全字段和防止XSS跨站脚本攻击过滤函数

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187

function escape($string) {     global $_POST;     $search = array (         '/</i',         '/>/i',         '/\">/i',         '/\bunion\b/i',         '/load_file(\s*(\/\*.*\*\/)?\s*)+\(/i',         '/into(\s*(\/\*.*\*\/)?\s*)+outfile/i',         '/\bor\b/i',         '/\<([\/]?)script([^\>]*?)\>/si',         '/\<([\/]?)iframe([^\>]*?)\>/si',         '/\<([\/]?)frame([^\>]*?)\>/si'     );     $replace = array (         '<',         '>',         '">',         'union ',         'load_file  (',         'into  outfile',         'or ',         '<\\1script\\2>',         '<\\1iframe\\2>',         '<\\1frame\\2>'     );     if (is_array ( $string )) {         $key = array_keys ( $string );         $size = sizeof ( $key );         for($i = 0; $i < $size; $i ++) {             $string [$key [$i]] = escape ( $string [$key [$i]] );         }     } else {         if (! $_POST ['stats_code'] && ! $_POST ['ad_type_code_content']) {             $string = str_replace ( array (                 '\n',                 '\r'             ), array (                 chr ( 10 ),                 chr ( 13 )             ), preg_replace ( $search, $replace, $string ) );             $string = remove_xss ( $string );         } else {             $string = $string;         }     }     return $string; }    function remove_xss($val) {     $val = preg_replace ( '/([\x00-\x08\x0b-\x0c\x0e-\x19])/', '', $val );        $search = 'abcdefghijklmnopqrstuvwxyz';     $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';     $search .= '1234567890!@#$%^&*()';     $search .= '~`";:?+/={}[]-_|\'\\';     for($i = 0; $i < strlen ( $search ); $i ++) {            $val = preg_replace ( '/(&#[xX]0{0,8}' . dechex ( ord ( $search [$i] ) ) . ';?)/i', $search [$i], $val );            $val = preg_replace ( '/(�{0,8}' . ord ( $search [$i] ) . ';?)/', $search [$i], $val );     }        $ra1 = array (         'javascript',         'vbscript',         'expression',         'applet',         'meta',         'xml',         'blink',         'script',         'object',         'iframe',         'frame',         'frameset',         'ilayer',         'bgsound'     );     $ra2 = array (         'onabort',         'onactivate',         'onafterprint',         'onafterupdate',         'onbeforeactivate',         'onbeforecopy',         'onbeforecut',         'onbeforedeactivate',         'onbeforeeditfocus',         'onbeforepaste',         'onbeforeprint',         'onbeforeunload',         'onbeforeupdate',         'onblur',         'onbounce',         'oncellchange',         'onchange',         'onclick',         'oncontextmenu',         'oncontrolselect',         'oncopy',         'oncut',         'ondataavailable',         'ondatasetchanged',         'ondatasetcomplete',         'ondblclick',         'ondeactivate',         'ondrag',         'ondragend',         'ondragenter',         'ondragleave',         'ondragover',         'ondragstart',         'ondrop',         'onerror',         'onerrorupdate',         'onfilterchange',         'onfinish',         'onfocus',         'onfocusin',         'onfocusout',         'onhelp',         'onkeydown',         'onkeypress',         'onkeyup',         'onlayoutcomplete',         'onload',         'onlosecapture',         'onmousedown',         'onmouseenter',         'onmouseleave',         'onmousemove',         'onmouseout',         'onmouseover',         'onmouseup',         'onmousewheel',         'onmove',         'onmoveend',         'onmovestart',         'onpaste',         'onpropertychange',         'onreadystatechange',         'onreset',         'onresize',         'onresizeend',         'onresizestart',         'onrowenter',         'onrowexit',         'onrowsdelete',         'onrowsinserted',         'onscroll',         'onselect',         'onselectionchange',         'onselectstart',         'onstart',         'onstop',         'onsubmit',         'onunload'     );     $ra = array_merge ( $ra1, $ra2 );        $found = true;     while ( $found == true ) {         $val_before = $val;         for($i = 0; $i < sizeof ( $ra ); $i ++) {             $pattern = '/';             for($j = 0; $j < strlen ( $ra [$i] ); $j ++) {                 if ($j > 0) {                     $pattern .= '(';                     $pattern .= '(&#[xX]0{0,8}([9ab]);)';                     $pattern .= '|';                     $pattern .= '|(�{0,8}([9|10|13]);)';                     $pattern .= ')*';                 }                 $pattern .= $ra [$i] [$j];             }             $pattern .= '/i';             $replacement = substr ( $ra [$i], 0, 2 ) . ' ' . substr ( $ra [$i], 2 );             $val = preg_replace ( $pattern, $replacement, $val );             if ($val_before == $val) {                    $found = false;             }         }     }     return $val; }