PHP XSS 安全過濾器完整實作

跨站腳本攻擊 (XSS) 是 Web 最常見漏洞。本文提供一個健壯的 remove_xss() 函數，涵蓋：非可列印字元清理、實體編碼還原、事件處理器/危隆標籤移除、十六進位/十進位實體攻擊向量阻斷、遞迴清理直到無變化。適合作為輸入端通用清洗 (輸出端仍建議配合 htmlspecialchars 依上下文編碼)。

完整過濾器代碼

function remove_xss($val) {
    // 1. 移除控制字元 (保留 \t \n \r)
    $val = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $val);

    // 2. 實體還原：將 &#xHH; &#DDD; 還原為原字元，防止繞過
    $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()~`";:?/={}[]-_|\'\\';
    for ($i = 0; $i < strlen($chars); $i++) {
        $c = $chars[$i];
        $hex = dechex(ord($c));
        $dec = ord($c);
        $val = preg_replace("/�*$hex;?/i", $c, $val);
        $val = preg_replace("/�*$dec;?/", $c, $val);
    }

    // 3. 危險關鍵字清單 (標籤 + 事件屬性)
    $tags = ['javascript','vbscript','expression','applet','meta','xml','blink','link','style','script','embed','object','iframe','frame','frameset','ilayer','layer','bgsound','title','base'];
    $events = ['onabort','onactivate','onafterprint','onafterupdate','onbeforeactivate','onbeforecopy','onbeforecut','onbeforedeactivate','onbeforeeditfocus','onbeforepaste','onbeforeprint','onbeforeunload','onbeforeupdate','onblur','onbounce','oncellchange','onchange','onclick','oncontextmenu','oncontrolselect','oncopy','oncut','ondataavailable','ondatasetchanged','ondatasetcomplete','ondblclick','ondeactivate','ondrag','ondragend','ondragenter','ondragleave','ondragover','ondragstart','ondrop','onerror','onerrorupdate','onfilterchange','onfinish','onfocus','onfocusin','onfocusout','onhelp','onkeydown','onkeypress','onkeyup','onlayoutcomplete','onload','onlosecapture','onmousedown','onmouseenter','onmouseleave','onmousemove','onmouseout','onmouseover','onmouseup','onmousewheel','onmove','onmoveend','onmovestart','onpaste','onpropertychange','onreadystatechange','onreset','onresize','onresizeend','onresizestart','onrowenter','onrowexit','onrowsdelete','onrowsinserted','onscroll','onselect','onselectionchange','onselectstart','onstart','onstop','onsubmit','onunload'];
    $patterns = array_merge($tags, $events);

    // 4. 遞迴替換：在關鍵字字元間插入  破壞結構
    $changed = true;
    while ($changed) {
        $changed = false;
        $old = $val;
        foreach ($patterns as $kw) {
            $pattern = '';
            for ($j = 0; $j < strlen($kw); $j++) {
                if ($j > 0) {
                    // 允許字元間夾雜實體編碼 (\t \n \r 等)
                    $pattern .= '(?:�*[9ab];|�*[9|10|13];)*';
                }
                $pattern .= preg_quote($kw[$j], '/');
            }
            $pattern = "/$pattern/i";
            $replacement = substr($kw, 0, 2) . '' . substr($kw, 2);
            $val = preg_replace($pattern, $replacement, $val);
        }
        if ($val !== $old) $changed = true;
    }
    return $val;
}

使用範例

$evil = '';
echo remove_xss($evil);
// 輸出: ror=alert(1)>

$evil2 = '';
echo remove_xss($evil2);
// 輸出: ript>eval(String.fromCharCode(97,108,101,114,116,40,49,41))ript>

防禦深度策略 (必讀)

推薦庫

• HTMLPurifier：標準庫，白名單機制、支援 HTML5、可配置極細緻，但效能較低。
• mewebstudio/Purifier：Laravel 封裝 HTMLPurifier。
• laminas/laminas-escaper：依上下文編碼 (HTML/JS/CSS/URL/HTML 屬性)。

本函數適合輕量級專案或作為第二道防線，**切勿單獨依賴** 替代輸出編碼與 CSP。