整理php防注入和XSS攻击通用过滤

function xss_clean($data){
 // Fix &entity＼n;
 $data=str_replace(array('&','<','>'),array('&','<','>'),$data);
 $data=preg_replace('/(&#＼w+)[＼x00-＼x20]+;/u','$1;',$data);
 $data=preg_replace('/(&#x[0-9A-F]+);/iu','$1;',$data);
 $data=html_entity_decode($data,ENT_COMPAT,'UTF-8');
 // Remove any attribute starting with "on" or xmlns
 $data=preg_replace('#(<[^>]+?[＼x00-＼x20"＼'])(?:on|xmlns)[^>]+>#iu','$1>',$data);
 // Remove javascript: and vbscript: protocols
 $data=preg_replace('#([a-z])[＼x00-＼x20]=[＼x00-＼x20]([`＼'"])[＼x00-＼x20]j[＼x00-＼x20]a[＼x00-＼x20]v[＼x00-＼x20]a[＼x00-＼x20]s[＼x00-＼x20]c[＼x00-＼x20]r[＼x00-＼x20]i[＼x00-＼x20]p[＼x00-＼x20]t[＼x00-＼x20]:#iu','$1=$2nojavascript...',$data);
 $data=preg_replace('#([a-z])[＼x00-＼x20]=([＼'"])[＼x00-＼x20]v[＼x00-＼x20]b[＼x00-＼x20]s[＼x00-＼x20]c[＼x00-＼x20]r[＼x00-＼x20]i[＼x00-＼x20]p[＼x00-＼x20]t[＼x00-＼x20]:#iu','$1=$2novbscript...',$data);
 $data=preg_replace('#([a-z])[＼x00-＼x20]=([＼'"])[＼x00-＼x20]-moz-binding[＼x00-＼x20]:#u','$1=$2nomozbinding...',$data);
 // Only works in IE: <span style="width: expression(alert('Ping!'));"></span>
 $data=preg_replace('#(<[^>]+?)style[＼x00-＼x20]=[＼x00-＼x20][`＼'"].?expression[＼x00-＼x20]＼([^>]+>#i','$1>',$data);
 $data=preg_replace('#(<[^>]+?)style[＼x00-＼x20]=[＼x00-＼x20][`＼'"].?behaviour[＼x00-＼x20]＼([^>]+>#i','$1>',$data);
 $data=preg_replace('#(<[^>]+?)style[＼x00-＼x20]=[＼x00-＼x20][`＼'"].?s[＼x00-＼x20]c[＼x00-＼x20]r[＼x00-＼x20]i[＼x00-＼x20]p[＼x00-＼x20]t[＼x00-＼x20]:[^>]+>#iu','$1>',$data);
 // Remove namespaced elements (we do not need them)
 $data=preg_replace('#</＼w+:＼w[^>]+>#i','',$data);
 do{// Remove really unwanted tags
 $old_data=$data;
 $data=preg_replace('#</(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]+>#i','',$data);
 }while($old_data!==$data);
 // we are done...
 return $data;
}

<?php
//php防注入和XSS攻击通用过滤. 
//by qq:831937
$_GET     && SafeFilter($_GET);
$_POST    && SafeFilter($_POST);
$_COOKIE  && SafeFilter($_COOKIE);
 
function SafeFilter (&$arr) 
{
    
   $ra=Array('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/','/script/','/javascript/','/vbscript/','/expression/','/applet/','/meta/','/xml/','/blink/','/link/','/style/','/embed/','/object/','/frame/','/layer/','/title/','/bgsound/','/base/','/onload/','/onunload/','/onchange/','/onsubmit/','/onreset/','/onselect/','/onblur/','/onfocus/','/onabort/','/onkeydown/','/onkeypress/','/onkeyup/','/onclick/','/ondblclick/','/onmousedown/','/onmousemove/','/onmouseout/','/onmouseover/','/onmouseup/','/onunload/');
    
   if (is_array($arr))
   {
     foreach ($arr as $key => $value) 
     {
        if (!is_array($value))
        {
          if (!get_magic_quotes_gpc())             //不对magic_quotes_gpc转义过的字符使用addslashes(),避免双重转义。
          {
             $value  = addslashes($value);           //给单引号（'）、双引号（"）、反斜线（\）与 NUL（NULL 字符）加上反斜线转义
          }
          $value       = preg_replace($ra,'',$value);     //删除非打印字符，粗暴式过滤xss可疑字符串
          $arr[$key]     = htmlentities(strip_tags($value)); //去除 HTML 和 PHP 标记并转换为 HTML 实体
        }
        else
        {
          SafeFilter($arr[$key]);
        }
     }
   }
}
?>