php xss 필터

이것저것 다 해봤는데

결국엔 걍 치환하는게 짱인듯

$user_input = strip_tags($user_input);

while(preg_match('/<\/?(script|style)/m', $user_input)) {

$user_input = preg_replace('/<\/?(script|style)/m','',$user_input);

}

while(preg_match('/<[a-aA-Z]+.+on(mouseover|load|click|error)=".*"\/?>/m',$user_input)) {

$user_input = preg_replace('/(<[a-aA-Z]+.+)on(mouseover|load|click|error)=".*"(\/?>)/m','XX', $user_input);

}

이런식으로 했었는데 잘 안되더라

str_replace 로 걍 치환 ㄱㄱ

$arrchn = array("onabort",

"onactivate",

"onafterprint",

"onafterupdate",

"onbeforeactivate",

"onbeforecopy",

"onbeforecut",

"onbeforedeactivate",

"onbeforeeditfocus",

"onbeforepaste",

"onbeforeprint",

"onbeforeunload",

"onbeforeupdate",

"onbegin",

"onblur",

"onbounce",

"oncellchange",

"onchange",

"onclick",

"oncontentready",

"oncontentsave",

"oncontextmenu",

"oncontrolselect",

"oncopy",

"oncut",

"ondataavailable",

"ondatasetchanged",

"ondatasetcomplete",

"ondblclick",

"ondeactivate",

"ondetach",

"ondocumentready",

"ondrag",

"ondragdrop",

"ondragend",

"ondragenter",

"ondragleave",

"ondragover",

"ondragstart",

"ondrop",

"onend",

"onerror",

"onerrorupdate",

"onfilterchange",

"onfinish",

"onfocus",

"onfocusin",

"onfocusout",

"onhelp",

"onhide",

"onkeydown",

"onkeypress",

"onkeyup",

"onlayoutcomplete",

"onload",

"onlosecapture",

"onmediacomplete",

"onmediaerror",

"onmedialoadfailed",

"onmousedown",

"onmouseenter",

"onmouseleave",

"onmousemove",

"onmouseout",

"onmouseover",

"onmouseup",

"onmousewheel",

"onmove",

"onmoveend",

"onmovestart",

"onopenstatechange",

"onoutofsync",

"onpaste",

"onpause",

"onplaystatechange",

"onpropertychange",

"onreadystatechange",

"onrepeat",

"onreset",

"onresize",

"onresizeend",

"onresizestart",

"onresume",

"onreverse",

"onrowclick",

"onrowenter",

"onrowexit",

"onrowout",

"onrowover",

"onrowsdelete",

"onrowsinserted",

"onsave",

"onscroll",

"onseek",

"onselect",

"onselectionchange",

"onselectstart",

"onshow",

"onstart",

"onstop",

"onsubmit",

"onsyncrestored",

"ontimeerror",

"ontrackchange",

"onunload",

"onurlflip");