Question

i am using regex and blocking out the words document|window|alert|onmouseover|onclick to prevent xss, and people seem to be able to bypassing it by just typing doc\ument, how do i fix this ?

thanks!

—

edit: what about preventing xss server side? maybe refuse to serve any file that contains stuff in a GET variable?

Answer 1

Obviously, you would have to supply some meaningful detail to get any serious answer for your problem at hand.

As @David Dorward notes, the most easy option is to escape all HTML entities. That disables all HTML, but you don’t have to deal with the plight of fighting XSS attacks.

If you need to suppot HTML, consider using a pre-made Anti-XSS filter like HTML purifier that promises to reliably block such attempts.

HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant, something only achievable with a comprehensive knowledge of W3C’s specifications.