安全問題在程式設計開發中非常重要。要過濾使用者提交的內容,XSS是需要注意的一點。
XSS是使用者提交資料時,將惡意 javascript 程式碼插入網頁,例如無限循環、瘋狂警報等。頁面上的html元素（可能會被修改,例如登入表單的action）,這樣當使用者瀏覽頁面時,就會執行Web中嵌入的程式碼,從而實現使用者的特殊目的。
composer require ezyang/htmlpurifier
namespace App\Libraries;
/**
* Description of HTML Library
*
* @author https://roytuts.com
*/
class HTMLLibrary {
function __construct() {
require dirname(dirname(__DIR__)) . '/vendor/autoload.php';
}
public function purifierConfig() {
$config = \HTMLPurifier_Config::createDefault();
$purifier = new \HTMLPurifier($config);
return $purifier;
}
}
A table summarizing the differences for the impatient.
| Library | Version | Date | License | Whitelist | Removal | Well-formed | Nesting | Attributes | XSS safe | Standards safe |
|---|---|---|---|---|---|---|---|---|---|---|
| striptags | n/a | n/a | n/a | Yes (user) | Buggy | No | No | No | No | No |
| PHP Input Filter | 1.2.2 | 2005-10-05 | GPL | Yes (user) | Yes | No | No | Partial | Probably | No |
| HTML_Safe | 0.9.9beta | 2005-12-21 | BSD (3) | Mostly No | Yes | Yes | No | Partial | Probably | No |
| kses | 0.2.2 | 2005-02-06 | GPL | Yes (user) | Yes | No | No | Partial | Probably | No |
| htmLawed | 1.1.9.1 | 2009-02-26 | GPL | Yes (not default) | Yes (user) | Yes (user) | Partial | Partial | Probably | No |
| Safe HTML Checker | n/a | 2003-09-15 | n/a | Yes (bare) | Yes | Yes | Almost | Partial | Yes | Almost |
| HTML Purifier | 4.15.0 | 2022-09-18 | LGPL | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
資料來源:http://htmlpurifier.org/comparison