php实现XSS安全过滤的方法

本文实例讲述了php实现XSS安全过滤的方法。分享给大家供大家参考。具体如下：

    function remove_xss($val) {
      // remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed
      // this prevents some character re-spacing such as <java\0script>
      // note that you have to handle splits with \n, \r, and \t later since they *are* allowed in some inputs
      $val = preg_replace('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/', '', $val);
      // straight replacements, the user should never need these since they're normal characters
      // this prevents like <IMG SRC=@avascript:alert('XSS')>
      $search = 'abcdefghijklmnopqrstuvwxyz';
      $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
      $search .= '1234567890!@#$%^&*()';
      $search .= '~`";:?+/={}[]-_|\'\\';
      for ($i = 0; $i < strlen($search); $i++) {
       // ;? matches the ;, which is optional
       // 0{0,7} matches any padded zeros, which are optional and go up to 8 chars
       // @ @ search for the hex values
       $val = preg_replace('/(&#