function يخلصك من ثغرات XSS .

[jadweb.com]

السلام عليكم


function Remove XSS


وظيفة function هي حذف اي ثغرة من نوع XSS بشكل نهائي لو يتم استخدامه في اي برنامج راح يزيد نسبة الآمان بشكل كبير .

function RemoveXSS($val) {
   // remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed
   // this prevents some character re-spacing such as <java\0script>
   // note that you have to handle splits with \n, \r, and \t later since they *are* allowed in some inputs
   $val = preg_replace('/([\x00-\x08][\x0b-\x0c][\x0e-\x20])/', '', $val);

   // straight replacements, the user should never need these since they're normal characters
   // this prevents like <IMG SRC=&#X40&#X61&#X76&#X61&#X73&#X63&#X72&#X69&#X70&#X74&#X3A&#X61&#X6C&#X65&#X72&#X74&#X28&#X27&#X58&#X53&#X53&#X27&#X29>
   $search = 'abcdefghijklmnopqrstuvwxyz';
   $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
   $search .= '1234567890!@#$%^&*()';
   $search .= '~`";:?+/={}[]-_|\'\\';
   for ($i = 0; $i < strlen($search); $i++) {
      // ;? matches the ;, which is optional
      // 0{0,7} matches any padded zeros, which are optional and go up to 8 chars

      // &#x0040 @ search for the hex values
      $val = preg_replace('/(&#[x|X]0{0,8}'.dechex(ord($search[$i])).';?)/i', $search[$i], $val); // with a ;
      // &#00064 @ 0{0,7} matches '0' zero to seven times
      $val = preg_replace('/(&#0{0,8}'.ord($search[$i]).';?)/', $search[$i], $val); // with a ;
   }

   // now the only remaining whitespace attacks are \t, \n, and \r
   $ra1 = Array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'style', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base');
   $ra2 = Array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload');
   $ra = array_merge($ra1, $ra2);

   $found = true; // keep replacing as long as the previous round replaced something
   while ($found == true) {
      $val_before = $val;
      for ($i = 0; $i < sizeof($ra); $i++) {
         $pattern = '/';
         for ($j = 0; $j < strlen($ra[$i]); $j++) {
            if ($j > 0) {
               $pattern .= '(';
               $pattern .= '(&#[x|X]0{0,8}([9][a][b]);?)?';
               $pattern .= '|(&#0{0,8}([9][10][13]);?)?';
               $pattern .= ')?';
            }
            $pattern .= $ra[$i][$j];
         }
         $pattern .= '/i';
         $replacement = substr($ra[$i], 0, 2).'<x>'.substr($ra[$i], 2); // add in <> to nerf the tag
         $val = preg_replace($pattern, $replacement, $val); // filter out the hex tags
         if ($val_before == $val) {
            // no replacements were made, so exit the loop
            $found = false;
         }
      }
   }
} 

مرفق ايضا ً للتوضيح بشكل اكبر .


بدر العنزي

[موقع روش]

جميل جزاك الله خير

[jadweb.com]

العفو اخوي .

[أبوبسام]

جزاك الله خير بس وين أضعه في ملفات السكربت

[jadweb.com]

يجب تمرير ذلك قبل ادخال البيانات للقاعدة او العكس

مثال

$name = RemoveXSS($HTTP_POST_VARS['name']); 

[ac4p.com]

جزاك الله كل خير أخوي بدر العنزي

[الفايق]

جزاك الله خير ،، وزادك في العلم

[hawint]

جزاك الله خير

[Milad]

ألا تعتقد أنها طويلة؟

[jadweb.com]

من واقع تجربة استخدم بي بي كود خاص بي في اي برنامج استخدم كما هو في المنتديات و غيرها و هي افضل طريقة آمنة , من ناحية طويل اكيد طويل و افضل شيء به

$ra1 = Array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'style', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base'); 
   $ra2 = Array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload'); 

ما رايك .

[هكرز المنتديات]

أخي jadweb.com

مشكور على هذه الفانكشن لكن ياريت لو بـأمثلة بسيطة تشرح لنا طريقة استخدامها .. وأين يتم وضعها تحديداً ...

وهل تفي بالغرض من ناحية الحماية من أخطار الـ SQL INJECTION و أخطار XSS
أم فقط أخطار XSS

وشكرا لك

[DNSerror]

أصدقائي الأعزاء، أنا عادة أستخدم التابع التالي:

function CleanXSS($str){
    // One of the easiest way to do XSS is to use one of the on* attributes, like onclick or onload.
    // With this you can easily execute a script, without the user even having to do something (with onload, etc)
    // or just having to click or hover over something. We just remove them all with
    $str = preg_replace('#(<[^>]+[\s\r\n\"\'])(on|xmlns)[^>]*>#iU',"$1>",$str);
    
    // As you certainly know, can you use javascript: and vbscript: as protocol handlers instead of http:// and others.
    // Something like <a href="javascript:alert('foobar')">lll</a> executes just nicely if a user clicks on it.
    // We of course remove that as well. IE as also the strange behaviour that something like "java script :" is also valid,
    // so we have to check for a whitespace between every character.
    $str = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([\`\'\"]*)[\\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iU','$1=$2nojavascript...',$str);
    $str = preg_replace('#([a-z]*)[\x00-\x20]*=([\'\"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iU','$1=$2novbscript...',$str);
    
    // We removed all namespace declarations above, here we remove all elements, which have a prefix, they are not needed in HTML..
    $str = preg_replace('#</*\w+:\w[^>]*>#i','',$str);
    
    // There are quite some elements in HTML, which you definitively don't want in something like user comments.
    // The reason for the while loop is, that stuff like
    // <sc<script>ript>alert('hello')</sc</script>ript>
    // We remove them with:
    do {
        $oldstr = $str;
        $str = preg_replace('#</*(\?xml|applet|meta|xml|blink|link|style|script|object|iframe|frame|frameset|ilayer|layer|bgsound|title|base)[^>]*>#i',"",$str);
    } while ($oldstr != $str);
    
    return $str;
} 

[هكرز المنتديات]

وهل تفي بالغرض من ناحية الحماية من أخطار الـ SQL INJECTION و أخطار XSS
أم فقط أخطار XSS ...........؟؟؟؟؟؟؟؟

[هكرز المنتديات]

هل أستطيع الحصول على دالة تقوم بالحماية من أخطار الـ SQL INJECTION و أخطار XSS معاً

[محمد الطويل]

أصدقائي الأعزاء، أنا عادة أستخدم التابع التالي:

function CleanXSS($str){
    // One of the easiest way to do XSS is to use one of the on* attributes, like onclick or onload.
    // With this you can easily execute a script, without the user even having to do something (with onload, etc)
    // or just having to click or hover over something. We just remove them all with
    $str = preg_replace('#(<[^>]+[\s\r\n\"\'])(on|xmlns)[^>]*>#iU',"$1>",$str);
    
    // As you certainly know, can you use javascript: and vbscript: as protocol handlers instead of http:// and others.
    // Something like <a href="javascript:alert('foobar')">lll</a> executes just nicely if a user clicks on it.
    // We of course remove that as well. IE as also the strange behaviour that something like "java script :" is also valid,
    // so we have to check for a whitespace between every character.
    $str = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([\`\'\"]*)[\\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iU','$1=$2nojavascript...',$str);
    $str = preg_replace('#([a-z]*)[\x00-\x20]*=([\'\"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iU','$1=$2novbscript...',$str);
    
    // We removed all namespace declarations above, here we remove all elements, which have a prefix, they are not needed in HTML..
    $str = preg_replace('#</*\w+:\w[^>]*>#i','',$str);
    
    // There are quite some elements in HTML, which you definitively don't want in something like user comments.
    // The reason for the while loop is, that stuff like
    // <sc<script>ript>alert('hello')</sc</script>ript>
    // We remove them with:
    do {
        $oldstr = $str;
        $str = preg_replace('#</*(\?xml|applet|meta|xml|blink|link|style|script|object|iframe|frame|frameset|ilayer|layer|bgsound|title|base)[^>]*>#i',"",$str);
    } while ($oldstr != $str);
    
    return $str;
} 

يبدو لي انه دالة قويه جداً ..

هل أنت قمت ببرمجته ؟