【发布时间】：2016-07-23 08:17:42
【问题描述】：
所以基本上有人告诉我我的网站容易受到 XSS 攻击，所以我正在努力解决这个问题。有人告诉我 htmlspecialchars 方法是防止这种情况的好方法。
我做了这个功能
function _e($string){
return htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
}
我正在使用它，如下所示
$userName = _e($_POST['userName']);
$Pass = _e($_POST['password']);
问题：
1) XSS 攻击是否仅基于输入，还是我需要对警报和回显语句执行此操作？
2) 我是否成功阻止了以下页面中的 XSS 攻击？**
<?php
session_start();
if(isset($_SESSION['user_id'])){
header("Location: index.php");
}
function _e($string){
return htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
}
include '../includes/connection.php';
$userName = _e($_POST['userName']);
$Pass = _e($_POST['password']);
if(!empty($userName) && !empty($Pass)){
$sql = "SELECT * FROM Admins WHERE Username='$userName'";
$sqlr = mysqli_query($connect,$sql);
$sqlrow = $sqlr->fetch_assoc();
$dbPass = $sqlrow['Password'];
$hash = password_verify($Pass, $dbPass);
if ($hash == 0){
die("There was no password found matching what you have entered.");
}else{
$records = "SELECT * FROM Admins WHERE Username='$userName' AND Password='$dbPass' AND AdminLevel >=1";
$results = mysqli_query($connect,$records);
if ($results->num_rows == 1){
$row = $results->fetch_assoc();
$_SESSION['user_id'] = $row['ID'];
$_SESSION['admin_level'] = $row['AdminLevel'];
$_SESSION['user_name'] = $row['Username'];
$easyName = $_SESSION['user_name'];
$recordsS = "UPDATE `Admins` SET Status='1' WHERE Username='$userName'";
$resultsS = mysqli_query($connect,$recordsS);
header("Location: index.php");
}else{
$message = "Either you have entered the incorrect login information, or you account has not been approved yet.";
echo "<script type='text/javascript'>alert('$message');</script>";
}
}
}
?>
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>ServerSide Moderation Services</title>
<link rel="stylesheet" href="../styles/mainStyles.css" type="text/css" />
<link rel="stylesheet" href="../styles/loginFormStyle.css" type="text/css" />
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
</head>
<body class="body">
<?php include '../includes/header.php'; ?>
<div class="mainContent">
<div class="logRegArea">
<article class="leftContent">
<header>
<h2 class="loginArea" style="text-align:center">Login Below:</h2>
</header>
<content>
<div id="login">
<form action="../pages/login.php" method="POST">
<input type="text" placeholder="Enter Your Username" name="userName">
<input type="password" placeholder="Enter Your Password" name="password">
<input type="submit">
</form>
</div>
</content>
</article>
</div>
</div>
<footer class="mainFooter">
<p>This website was developed by ROBLOX user: <a href="https://www.roblox.com/users/8869935/profile" title="Made by: wattleman">wattleman</a></p>
</footer>
</body>
</html>
【问题讨论】：
-
密码请使用 PHP 的散列函数。永远不要存储纯文本密码！