voku/anti-xss

GitHub: voku/anti-xss

一个基于 PHP 的跨站脚本（XSS）防护库，提供细粒度的输入清洗与检测方法。

Stars: 706 | Forks: 116

[![SWUbanner](https://static.pigsec.cn/wp-content/uploads/repos/2026/04/e1c4361537222815.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md) [![Build Status](https://static.pigsec.cn/wp-content/uploads/repos/2026/04/daccb2f512222816.svg)](https://github.com/voku/anti-xss/actions) [![codecov.io](http://codecov.io/github/voku/anti-xss/coverage.svg?branch=master)](http://codecov.io/github/voku/anti-xss?branch=master) [![Codacy Badge](https://api.codacy.com/project/badge/Grade/8e3c9da417124971b8d8e0c1046c24c7)](https://www.codacy.com/app/voku/anti-xss) [![Latest Stable Version](https://poser.pugx.org/voku/anti-xss/v/stable)](https://packagist.org/packages/voku/anti-xss) [![Total Downloads](https://poser.pugx.org/voku/anti-xss/downloads)](https://packagist.org/packages/voku/anti-xss) [![License](https://poser.pugx.org/voku/anti-xss/license)](https://packagist.org/packages/voku/anti-xss) [![Donate to this project using Paypal](https://img.shields.io/badge/paypal-donate-yellow.svg)](https://www.paypal.me/moelleken) [![Donate to this project using Patreon](https://img.shields.io/badge/patreon-donate-yellow.svg)](https://www.patreon.com/voku) # :secret: AntiXSS "Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by Symantec as of 2007." - http://en.wikipedia.org/wiki/Cross-site_scripting ### DEMO: [http://anti-xss-demo.suckup.de/](http://anti-xss-demo.suckup.de/) ### NOTES: 1. Use [filter_input()](http://php.net/manual/de/function.filter-input.php) - don't use GLOBAL-Array (e.g. $_SESSION, $_GET, $_POST, $_SERVER) directly 2. Use [html-sanitizer](https://github.com/tgalopin/html-sanitizer) or [HTML Purifier](http://htmlpurifier.org/) if you need a more configurable solution 3. Add "Content Security Policy's" -> [Introduction to Content Security Policy](http://www.html5rocks.com/en/tutorials/security/content-security-policy/) 4. DO NOT WRITE YOUR OWN REGEX TO PARSE HTML! 5. READ THIS TEXT -> [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md) 6. TEST THIS TOOL -> [Zed Attack Proxy (ZAP)](https://github.com/zaproxy/zaproxy) ### 通过 "composer require" 安装 ``` composer require voku/anti-xss ``` ### 用法： ``` use voku\helper\AntiXSS; require_once __DIR__ . '/vendor/autoload.php'; // example path $antiXss = new AntiXSS(); ``` Example 1: (HTML Character) ``` $harm_string = "Hello, i try to your site"; $harmless_string = $antiXss->xss_clean($harm_string); // Hello, i try to alert('Hack'); your site ``` Example 2: (Hexadecimal HTML Character) ``` $harm_string = "

"; $harmless_string = $antiXss->xss_clean($harm_string); // ``` Example 3: (Unicode Hex Character) ``` $harm_string = "CLICK"; $harmless_string = $antiXss->xss_clean($harm_string); // CLICK ``` Example 4: (Unicode Character) ``` $harm_string = "CLICK "; $harmless_string = $antiXss->xss_clean($harm_string); // CLICK ``` Example 5.1: (non Inline CSS) ``` $harm_string = '

'; $harmless_string = $antiXss->xss_clean($harm_string); //

``` Example 5.2: (with Inline CSS) ``` $harm_string = '

'; $antiXss->removeEvilAttributes(array('style')); // allow style-attributes $harmless_string = $antiXss->xss_clean($harm_string); //

``` Example 6: (check if an string contains a XSS attack) ``` $harm_string = "\x3cscript src=http://www.example.com/malicious-code.js\x3e\x3c/script\x3e"; $harmless_string = $antiXss->xss_clean($harm_string); // $antiXss->isXssFound(); // true ``` Example 7: (allow e.g. iframes) ``` $harm_string = ""; $antiXss->removeEvilHtmlTags(array('iframe')); $harmless_string = $antiXss->xss_clean($harm_string); // ``` ### 单元测试： 1. [Composer](https://getcomposer.org) is a prerequisite for running the tests. ``` composer install ``` 2. The tests can be executed by running this command from the root directory: ``` ./vendor/bin/phpunit ``` ## AntiXss 方法

addDoNotCloseHtmlTags	addEvilAttributes	addEvilHtmlTags	addNeverAllowedCallStrings
addNeverAllowedJsCallbackRegex	addNeverAllowedOnEventsAfterwards	addNeverAllowedRegex	addNeverAllowedStrAfterwards
addNaughtyJavascriptPatterns	isXssFound	removeDoNotCloseHtmlTags	removeEvilAttributes
removeEvilHtmlTags	removeNeverAllowedCallStrings	removeNeverAllowedJsCallbackRegex	removeNeverAllowedOnEventsAfterwards
removeNeverAllowedRegex	removeNeverAllowedStrAfterwards	setKeepPreAndCodeTagContent	setReplacement	setStripe4byteChars
xss_clean

## addDoNotCloseHtmlTags(string[] $strings): $this ↑ Add some strings to the "_do_not_close_html_tags"-array. **Parameters:** - `string[] $strings` **Return:** - `$this` ## addEvilAttributes(string[] $strings): $this ↑ Add some strings to the "_evil_attributes"-array. **Parameters:** - `string[] $strings` **Return:** - `$this` ## addEvilHtmlTags(string[] $strings): $this ↑ Add some strings to the "_evil_html_tags"-array. **Parameters:** - `string[] $strings` **Return:** - `$this` ## addNeverAllowedCallStrings(string[] $strings): $this ↑ Add some strings to the "_never_allowed_call_strings"-array. **Parameters:** - `string[] $strings` **Return:** - `$this` ## addNeverAllowedJsCallbackRegex(string[] $strings): $this ↑ Add some strings to the "_never_allowed_js_callback_regex"-array. **Parameters:** - `string[] $strings` **Return:** - `$this` ## addNeverAllowedOnEventsAfterwards(string[] $strings): $this ↑ Add some strings to the "_never_allowed_on_events_afterwards"-array. **Parameters:** - `string[] $strings` **Return:** - `$this` ## addNeverAllowedRegex(string[] $strings): $this ↑ Add some strings to the "_never_allowed_regex"-array. **Parameters:** - `string[] $strings` **Return:** - `$this` ## addNeverAllowedStrAfterwards(string[] $strings): $this ↑ Add some strings to the "_never_allowed_str_afterwards"-array. **Parameters:** - `string[] $strings` **Return:** - `$this` ## addNaughtyJavascriptPatterns(string[] $strings): $this ↑ Add some strings to the "_naughty_javascript_patterns"-array. **Parameters:** - `string[] $strings` **Return:** - `$this` ## isXssFound(): bool|null ↑ Check if the "AntiXSS->xss_clean()" method found an XSS attack in the last run. **Parameters:** __nothing__ **Return:** - `bool|null

Will return null if the "xss_clean()" wasn't running at all.

` ## removeDoNotCloseHtmlTags(string[] $strings): $this ↑ Remove some strings from the "_do_not_close_html_tags"-array.