Stored Cross Site Scripting (XSS)

最新推荐文章于 2025-02-20 18:29:41 发布

原创最新推荐文章于 2025-02-20 18:29:41 发布 · 1.1k 阅读

0 ·

CC 4.0 BY-SA版权

本文通过三个不同安全级别的示例，探讨了PHP编程中输入验证与数据过滤的重要性，尤其是在防止SQL注入与XSS攻击方面。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

low：

 <?php

if(isset($_POST['btnSign']))
{

   $message = trim($_POST['mtxMessage']);
   $name    = trim($_POST['txtName']);
   
   // Sanitize message input
   $message = stripslashes($message);
   $message = mysql_real_escape_string($message);
   
   // Sanitize name input
   $name = mysql_real_escape_string($name);
  
   $query = "INSERT INTO guestbook (comment,name) VALUES ('$message','$name');";
   
   $result = mysql_query($query) or die('<pre>' . mysql_error() . '</pre>' );
   
}

?>

1 <script>alert('/xss1/');</script>

medium:

<?php

if(isset($_POST['btnSign']))
{

   $message = trim($_POST['mtxMessage']);
   $name    = trim($_POST['txtName']);
   
   // Sanitize message input
   $message = stripslashes($message);
   $message = mysql_real_escape_string($message);
   
   // Sanitize name input
   $name = mysql_real_escape_string($name);
  
   $query = "INSERT INTO guestbook (comment,name) VALUES ('$message','$name');";
   
   $result = mysql_query($query) or die('<pre>' . mysql_error() . '</pre>' );
   
}

?>

这里name是没有进行htmlspecialchars（）过滤的所以修改name的长度为 100然后 1 <scr<script>ipt>alert('2')</script> 突破str_replace()

high:

 <?php

if(isset($_POST['btnSign']))
{

   $message = trim($_POST['mtxMessage']);
   $name    = trim($_POST['txtName']);
   
   // Sanitize message input
   $message = stripslashes($message);
   $message = mysql_real_escape_string($message);
   $message = htmlspecialchars($message);
   
   // Sanitize name input
   $name = stripslashes($name);
   $name = mysql_real_escape_string($name); 
   $name = htmlspecialchars($name);
  
   $query = "INSERT INTO guestbook (comment,name) VALUES ('$message','$name');";
   
   $result = mysql_query($query) or die('<pre>' . mysql_error() . '</pre>' );
   
}

?>

万恶不会了 htmlspecialchars()怎么过滤