phpStudy
phpStudy
网站首页
软件下载
PHP教程
编程技术
PHP
MySQL
HTML
CSS
JavaScript
MSSQL
AJAX
.NET
JSP
window
Linux
Mac
ASP
服务器
CMS
SQL
jQuery
C#
C++
java
Android
IOS
oracle
MongoDB
PostgreSQL
SQLite
教程手册
php
html
html5
css
css3
JavaScript
ajax
jquery
sql
ado
asp
aspnet
browsers
careers
dhtml
dotnetmobile
dtd
e4x
glossary
hosting
htmldom
json
media
msnet
quality
rdf
rss
schema
semweb
site
sitemap
smil
soap
svg
tags
tcpip
vbscript
w3c
wap
web
webservices
wmlscript
wsdl
xforms
xhtml
xlink
xml
xmldom
xpath
xquery
xsl
xslfo
网站测速
小皮面板
智能dns
搜索
首页
PHP教程
javascript过滤危险脚本方法
javascript过滤危险脚本方法
下面是他们的字符串规则：
1、<(script|link|style|iframe)(.|\n)*<\/\1>\s*
2、\s*on[a-z]+\s*=\s*("[^"]+"|'[^']+'|[^\s]+)\s*(?=>)
3、\s*(href|src)\s*=\s*("\s*(javascript|vbscript):[^"]+"|'\s*(javascript|vbscript):[^']+'|(javascript|vbscript):[^\s]+)\s*(?=>)
4、epression\((.|\n)*\);?
了解他们的规则后，抓虫行动就水到渠成。
<textarea id="bug" cols="80" rows="16"> <button id="kick">抓虫1</button> <script> function kickBug(str) { return str.replace(/<(script|link|style|iframe)(.|\n)*\/\1>\s*/ig,""); } </script> <iframe></iframe> <link href='test.css'></link> <style> a { height:expression(alert('hei')); } </style> </textarea> <button id="kick">抓虫1</button> <script> function kickBug(str) { return str.replace(/<(script|link|style|iframe)(.|\n)*\/\1>\s*/ig,""); } if(!/msie/i.test(navigator.userAgent)){ HTMLElement.prototype.__defineGetter__("innerText",function(){ return this.textContent; }); HTMLElement.prototype.__defineSetter__("innerText",function(text){ this.textContent = text; }); } document.getElementById("kick").onclick = function() { var bug = document.getElementById("bug"); bug.innerText = kickBug(bug.innerText); } </script>
[Ctrl+A 全选 注:如需引入外部Js需刷新才能执行]
<textarea id="bug" cols="80" rows="5"> test </textarea> <button id="kick">抓虫2</button> <script> function kickBug(str) { return str.replace(/<[a-z][^>]*\s*on[a-z]+\s*=[^>]+/ig,function($0,$1){ return $0.replace(/\s*on[a-z]+\s*=\s*("[^"]+"|'[^']+'|[^\s]+)\s*/ig,""); }); } if(!/msie/i.test(navigator.userAgent)){ HTMLElement.prototype.__defineGetter__("innerText",function(){ return this.textContent; }); HTMLElement.prototype.__defineSetter__("innerText",function(text){ this.textContent = text; }); } document.getElementById("kick").onclick = function() { var bug = document.getElementById("bug"); bug.innerText = kickBug(bug.innerText); } </script>
[Ctrl+A 全选 注:如需引入外部Js需刷新才能执行]
<textarea id="bug" cols="80" rows="5"> test </textarea> <button id="kick">抓虫3</button> <script> function kickBug(str) { return str.replace(/<[a-z][^>]*\s*(href|src)\s*=[^>]+/ig,function($0,$1){ $0 = $0.replace(/&#(6[5-9]|[78][0-9]|9[0789]|1[01][0-9]|12[012]);?/g,function($0,$1){return String.fromCharCode($1);}); return $0.replace(/\s*(href|src)\s*=\s*("\s*(javascript|vbscript):[^"]+"|'\s*(javascript|vbscript):[^']+'|(javascript|vbscript):[^\s]+)/ig,""); }); } if(!/msie/i.test(navigator.userAgent)){ HTMLElement.prototype.__defineGetter__("innerText",function(){ return this.textContent; }); HTMLElement.prototype.__defineSetter__("innerText",function(text){ this.textContent = text; }); } document.getElementById("kick").onclick = function() { var bug = document.getElementById("bug"); bug.innerText = kickBug(bug.innerText); } </script>
[Ctrl+A 全选 注:如需引入外部Js需刷新才能执行]
<textarea id="bug" cols="80" rows="5"> expression() test </textarea> <button id="kick">抓虫4</button> <script> function kickBug(str) { return str.replace(/<[a-z][^>]*\s*style\s*=[^>]+/ig,function($0,$1){ $0 = $0.replace(/&#(6[5-9]|[78][0-9]|9[0789]|1[01][0-9]|12[012]);?/g,function($0,$1){return String.fromCharCode($1);}); return $0.replace(/\s*style\s*=\s*("[^"]+(expression)[^"]+"|'[^']+\2[^']+'|[^\s]+\2[^\s]+)\s*/ig,""); }); } if(!/msie/i.test(navigator.userAgent)){ HTMLElement.prototype.__defineGetter__("innerText",function(){ return this.textContent; }); HTMLElement.prototype.__defineSetter__("innerText",function(text){ this.textContent = text; }); } document.getElementById("kick").onclick = function() { var bug = document.getElementById("bug"); bug.innerText = kickBug(bug.innerText); } </script>
[Ctrl+A 全选 注:如需引入外部Js需刷新才能执行]
这样调用就可以
k1(k2(k3(k4(str))))
这样就是单纯地过滤脚本而已，所谓过滤“危险脚本”应该是能够判断哪些属于“危险"脚本，不危险的就不过滤才对……那可就难办了，相当于防火墙了。
«
»
PHP教程
PHP简介
PHP基本语法
PHP类型
PHP变量
PHP运算符
PHP控制结构
PHP函数
PHP类与对象
PHP异常处理
函数库分类
快速导航
PHP
MySQL
HTML
CSS
JavaScript
MSSQL
AJAX
.NET
JSP
Linux
Mac
ASP
服务器
SQL
jQuery
C#
C++
java
Android
IOS
oracle
MongoDB
SQLite
wamp
交通频道
Copyright © 2016 phpStudy | 豫ICP备2021030365号-3