voku / anti-xss

㊙️ AntiXSS | Protection against Cross-site scripting (XSS) via PHP
MIT License
680 stars 106 forks source link

Why is my output different from your example #135

Open ken678 opened 11 months ago

ken678 commented 11 months ago
$harm_string = "Hello, i try to <script>alert('Hack');</script> your site";
$harmless_string = $antiXss->xss_clean($harm_string);

// Hello, i try to your site
$harm_string = "<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>";
$harmless_string = $antiXss->xss_clean($harm_string);

// 
$harm_string = "<a href='&#x2000;javascript:alert(1)'>CLICK</a>";
$harmless_string = $antiXss->xss_clean($harm_string);

// <a href=' (1)'>CLICK</a>
$harm_string = "<a href=\"\u0001java\u0003script:alert(1)\">CLICK<a>";
$harmless_string = $antiXss->xss_clean($harm_string);

// <a href=' (1)'>CLICK</a>