i want to creating xss filter for my own project, this is for html event filtering

preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed));

but considering to more efective way, i would think this is more efectively clearing unquoted attribute like this

preg_replace('/on\w+=/i', '', $framed);

but i think would be another way that more efective?


Correctly filtering XSS from input is pretty hard. Most XSS filters can be bypassed by modifying the payload. For example, the following HTML will pass through your XSS filter:

<h1 onmouseover =alert`XSS`>Test</h1>

Because there is a space between onmouseover and =, your regex doesn't match. Another possible bypass is this:

<h1 oonmouseover=nmouseover=alert`XSS`>Test</h1>

The occurrence of onmouseover= will be removed once, leaving the following:

<h1 onmouseover=alert`XSS`>Test</h1>

One possibility is to use HTML Purifier, a library that is pretty good at cleaning up XSS. But the real solution against XSS is output encoding, so that when a user enters <script>alert(1), it just appears on the webpage as <script>alert(1) instead of being parsed as HTML.

  • i would think if i just filter the html event and replacing with string rather than deleting them in native. – Reyhan Fabiano Mar 7 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.