Home Backend Development PHP Tutorial How to prevent XSS cross-site attacks in Laravel 5

How to prevent XSS cross-site attacks in Laravel 5

Apr 11, 2018 am 10:55 AM
laravel how attack

这次给大家带来Laravel 5怎么阻止XSS的跨站攻击,Laravel 5怎么阻止XSS跨站攻击的注意事项有哪些,下面就是实战案例,一起来看一下。

本文实例讲述了Laravel5中防止XSS跨站攻击的方法。小编分享给大家供大家参考,具体如下:

Laravel 5本身没有这个能力来防止xss跨站攻击了,但是这它可以使用Purifier 扩展包集成 HTMLPurifier 防止 XSS 跨站攻击。

1、安装

HTMLPurifier 是基于 PHP 编写的富文本 HTML 过滤器,通常我们可以使用它来防止 XSS 跨站攻击,更多关于 HTMLPurifier的详情请参考其官网:http://htmlpurifier.org/。Purifier 是在 Laravel 5 中集成 HTMLPurifier 的扩展包,我们可以通过 Composer 来安装这个扩展包:

1

composer require mews/purifier

Copy after login

安装完成后,在配置文件config/app.php的providers中注册HTMLPurifier服务提供者:

1

2

3

4

5

6

7

8

9

'providers' => [

 // ...

 MewsPurifierPurifierServiceProvider::class,

]

然后在aliases中注册Purifier门面:

'aliases' => [

 // ...

 'Purifier' => MewsPurifierFacadesPurifier::class,

]

Copy after login

2、配置

要使用自定义的配置,发布配置文件到config目录:

1

php artisan vendor:publish

Copy after login

这样会在config目录下生成一个purifier.php文件:

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

return [

 'encoding' => 'UTF-8',

 'finalize' => true,

 'preload' => false,

 'cachePath' => null,

 'settings' => [

  'default' => [

   'HTML.Doctype'    => 'XHTML 1.0 Strict',

   'HTML.Allowed'    => 'p,b,strong,i,em,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]',

   'CSS.AllowedProperties' => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align',

   'AutoFormat.AutoParagraph' => true,

   'AutoFormat.RemoveEmpty' => true

  ],

  'test' => [

   'Attr.EnableID' => true

  ],

  "youtube" => [

   "HTML.SafeIframe" => 'true',

   "URI.SafeIframeRegexp" => "%^(http://|https://|//)(www.youtube.com/embed/|player.vimeo.com/video/)%",

  ],

 ],

];

Copy after login

3、使用示例

可以使用辅助函数clean:

1

clean(Input::get('inputname'));

Copy after login

或者使用Purifier门面提供的clean方法:

1

Purifier::clean(Input::get('inputname'));

Copy after login

还可以在应用中进行动态配置

1

2

clean('This is my H1 title''titles');

clean('This is my H1 title'array('Attr.EnableID' => true));

Copy after login

或者你也可以使用Purifier门面提供的方法:

1

2

Purifier::clean('This is my H1 title''titles');

Purifier::clean('This is my H1 title'array('Attr.EnableID' => true));

Copy after login

php防止xss攻击

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

<?PHP

function clean_xss(&$string, $low = False)

{

 if (! is_array ( $string ))

 {

 $string = trim ( $string );

 $string = strip_tags ( $string );

 $string = htmlspecialchars ( $string );

 if ($low)

 {

 return True;

 }

 $string = str_replace ( array (&#39;"&#39;, "\\", "&#39;", "/", "..", "../", "./", "//" ), &#39;&#39;, $string );

 $no = &#39;/%0[0-8bcef]/&#39;;

 $string = preg_replace ( $no, &#39;&#39;, $string );

 $no = &#39;/%1[0-9a-f]/&#39;;

 $string = preg_replace ( $no, &#39;&#39;, $string );

 $no = &#39;/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S&#39;;

 $string = preg_replace ( $no, &#39;&#39;, $string );

 return True;

 }

 $keys = array_keys ( $string );

 foreach ( $keys as $key )

 {

 clean_xss ( $string [$key] );

 }

}

//just a test

$str = &#39;<meta http-equiv="refresh" content="0;">';

clean_xss($str); //如果你把这个注释掉,你就知道xss攻击的厉害了

echo $str;

?>

Copy after login

相信看了本文案例你已经掌握了方法,更多精彩请关注php中文网其它相关文章!

推荐阅读:

PHP数组访问接口ArrayAccess使用详解

php如何统计二进制算法

The above is the detailed content of How to prevent XSS cross-site attacks in Laravel 5. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Hot Topics

Java Tutorial
1663
14
PHP Tutorial
1266
29
C# Tutorial
1237
24
Laravel Introduction Example Laravel Introduction Example Apr 18, 2025 pm 12:45 PM

Laravel is a PHP framework for easy building of web applications. It provides a range of powerful features including: Installation: Install the Laravel CLI globally with Composer and create applications in the project directory. Routing: Define the relationship between the URL and the handler in routes/web.php. View: Create a view in resources/views to render the application's interface. Database Integration: Provides out-of-the-box integration with databases such as MySQL and uses migration to create and modify tables. Model and Controller: The model represents the database entity and the controller processes HTTP requests.

Solve caching issues in Craft CMS: Using wiejeben/craft-laravel-mix plug-in Solve caching issues in Craft CMS: Using wiejeben/craft-laravel-mix plug-in Apr 18, 2025 am 09:24 AM

When developing websites using CraftCMS, you often encounter resource file caching problems, especially when you frequently update CSS and JavaScript files, old versions of files may still be cached by the browser, causing users to not see the latest changes in time. This problem not only affects the user experience, but also increases the difficulty of development and debugging. Recently, I encountered similar troubles in my project, and after some exploration, I found the plugin wiejeben/craft-laravel-mix, which perfectly solved my caching problem.

Laravel user login function Laravel user login function Apr 18, 2025 pm 12:48 PM

Laravel provides a comprehensive Auth framework for implementing user login functions, including: Defining user models (Eloquent model), creating login forms (Blade template engine), writing login controllers (inheriting Auth\LoginController), verifying login requests (Auth::attempt) Redirecting after login is successful (redirect) considering security factors: hash passwords, anti-CSRF protection, rate limiting and security headers. In addition, the Auth framework also provides functions such as resetting passwords, registering and verifying emails. For details, please refer to the Laravel documentation: https://laravel.com/doc

Laravel framework installation method Laravel framework installation method Apr 18, 2025 pm 12:54 PM

Article summary: This article provides detailed step-by-step instructions to guide readers on how to easily install the Laravel framework. Laravel is a powerful PHP framework that speeds up the development process of web applications. This tutorial covers the installation process from system requirements to configuring databases and setting up routing. By following these steps, readers can quickly and efficiently lay a solid foundation for their Laravel project.

Laravel and the Backend: Powering Web Application Logic Laravel and the Backend: Powering Web Application Logic Apr 11, 2025 am 11:29 AM

How does Laravel play a role in backend logic? It simplifies and enhances backend development through routing systems, EloquentORM, authentication and authorization, event and listeners, and performance optimization. 1. The routing system allows the definition of URL structure and request processing logic. 2.EloquentORM simplifies database interaction. 3. The authentication and authorization system is convenient for user management. 4. The event and listener implement loosely coupled code structure. 5. Performance optimization improves application efficiency through caching and queueing.

How to learn Laravel How to learn Laravel for free How to learn Laravel How to learn Laravel for free Apr 18, 2025 pm 12:51 PM

Want to learn the Laravel framework, but suffer from no resources or economic pressure? This article provides you with free learning of Laravel, teaching you how to use resources such as online platforms, documents and community forums to lay a solid foundation for your PHP development journey from getting started to master.

How to view the version number of laravel? How to view the version number of laravel How to view the version number of laravel? How to view the version number of laravel Apr 18, 2025 pm 01:00 PM

The Laravel framework has built-in methods to easily view its version number to meet the different needs of developers. This article will explore these methods, including using the Composer command line tool, accessing .env files, or obtaining version information through PHP code. These methods are essential for maintaining and managing versioning of Laravel applications.

What versions of laravel are there? How to choose the version of laravel for beginners What versions of laravel are there? How to choose the version of laravel for beginners Apr 18, 2025 pm 01:03 PM

In the Laravel framework version selection guide for beginners, this article dives into the version differences of Laravel, designed to assist beginners in making informed choices among many versions. We will focus on the key features of each release, compare their pros and cons, and provide useful advice to help beginners choose the most suitable version of Laravel based on their skill level and project requirements. For beginners, choosing a suitable version of Laravel is crucial because it can significantly impact their learning curve and overall development experience.

See all articles