php - How to output HTML but prevent XSS attacks

Question

Welcome To Ask or Share your Answers For Others

php - How to output HTML but prevent XSS attacks

posted Oct 17, 2021 in Technique[技术] by 深蓝 (71.8m points)

php - How to output HTML but prevent XSS attacks

I wrote a php script to fetch the email content.

These contents are HTML format.

I'd like to display the content, as below

<?php 
$email_content = '
    <html>
        <script>alert("XSS");</script>
        <body>
            <div>Line1</div>
            <div>Line2</div>
        </body>
    </html>
';
echo $email_content;
?>

As you can see, it will cause XSS attacks. But if I use htmlspecialchars function, it will not show the correct HTML format, how should I do in this case? Thanks.

See Question&Answers more detail:os

与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…

1 Reply

深蓝 · Answer 1 · 2021-10-17T03:08:56+0000

HTMLPurifer can do that:

require_once '/path/to/HTMLPurifier.auto.php';

$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
$clean_html = $purifier->purify($dirty_html);

It takes dirty HTML (ie possibly containing Javascript) and removes any script.

PHP doesn't have anything native or built in that can remove Javacript like HTMLPurifier. You could use DOMDocument but this would be a lengthy task because Javascript can execute in some attributes (onerror, onclick) and is not just limited to <script></script>.

Categories

php - How to output HTML but prevent XSS attacks

php - How to output HTML but prevent XSS attacks

Please log in or register to add a comment.

Please log in or register to reply this article.

1 Reply

Please log in or register to add a comment.

Just Browsing Browsing

Most popular tags