js过滤尖括号

最新推荐文章于 2023-08-17 18:16:30 发布

原创最新推荐文章于 2023-08-17 18:16:30 发布 · 1.5k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#javascript #xhtml #ViewUI

笔记专栏收录该内容

13 篇文章

订阅专栏

本文展示了一个使用HTML创建表单并利用jQuery进行数据处理的例子。通过预填充表单字段和字符串处理，演示了如何确保数据的安全显示，避免潜在的XSS攻击。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" lang="zh-CN" xml:lang="zh-CN">
<head>
<meta name="viewport"
	content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>测试</title>
<script type="text/javascript" src="jquery.js"></script>

</head>
<body>
<form id="testForm" style="display:none" action="test2.html" method="post" >
	<table>
		<tr><td><input type="text" name="service" id="service" value="" readonly="readonly" ></td></tr>
		<tr><td><input type="text" name ="time" id="time" value="" readonly="readonly"></td></tr>
		<tr><td><input type="text" name="partner" id="partner" value="" readonly="readonly"></td></tr>
		<tr><td><input type="text" name="sign" id="sign" value="" readonly="readonly"></td></tr>
	</table>
</form>
<script>
	$(function(){
		var payHelper = {};
		//var payHelper = e.PayHelper || e;
		payHelper.service="payservice<";
		payHelper.time=4563242321;
		payHelper.partner=2;
		payHelper.sign="sdf34df36dwfs>";

		for(var attr in payHelper ) { 
			$("#"+attr).val(payHelper[attr]);
			//console.log(attr+":"+payHelper[attr])
		} 
		var frm = document.getElementById('testForm');
		if(typeof(target)!='undefined'){
			frm.target=target;
		}
		//alert("form zhi = "+frm.elements(0))
		//frm.submit();

		var pattern = new RegExp("[`~!@#$^&*()=|{}':;',\\[\\].<>/?~！@#￥……&*（）——|{}【】‘；：”“'。，、？]/g") 
		//var r = /[?|\-|<|>]/g;
		var s = "123<script>alert(7838)<\/script>";
		s = s.replace(/[<]/g, "<").replace(/[>]/g, ">")
		alert("s = "+s);

		getElementsInput()

	})
	function toPay(e){

	}

	function getElementsInput(formId) {    
		var form = $("#testForm");    
		var elements = new Array();    
		var tagElements = $('#testForm input[type=text]');    
		for (var j = 0; j < tagElements.length; j++){  
			//elements.push(tagElements[j]);
			//alert(tagElements[j].id)	
			//alert($("#"+tagElements[j].id).val())
			//alert(tagElements[j].value.replace(/[<]/g, "<").replace(/[>]/g, ">"))
			alert($("#"+tagElements[j].id).val().replace(/[<]/g, "<").replace(/[>]/g, ">"))
			$("#"+tagElements[j].id).val($("#"+tagElements[j].id).val().replace(/[<]/g, "<").replace(/[>]/g, ">"))
			alert("最后 = "+$("#service").val())
		}  
		//return elements;    
	} 

	//var strtest = '<input type="hidden" name="jumpUrl" value="https://pay.baidu.com/front/userAccount/showMyAccount.htm"/><script>alert(7829)<script>">';
	var strtest = 'sadasd<script>alert(7244)<script>';
	var pRole = "/[~'!<>@#$%^&*()-+_=:]/g";	
	var pattern = new RegExp("[`~!@#$^&*()=|{}':;',\\[\\].<>/?~！@#￥……&*（）——|{}【】‘；：”“'。，、？]") 
	var a = '1234"/><script>alert(7838)<\/script>';
	function removeHTMLTag(str) {
		//str = str.replace(/<\/?[^>]*>/g,''); //去除HTML tag
		//str = str.replace(/[ | ]*\n/g,'\n'); //去除行尾空白
		//str = str.replace(/\n[\s| | ]*\r/g,'\n'); //去除多余空行
		//str=str.replace(/ /ig,'');//去掉 
		//alert("a = "+str.replace(pattern, ''))
		str = a.replace(pattern, ''); 
		return str;
	}

</script>
</body> 
</html>