如何防止XSS和CSS注入？ [关闭]

Question

I've made a function to deal with CSS and XSS injecting but its still getting through.

Someone said the following to me, but I'm not sure what it means:

On your sanitize_input function, do a strip_tags to strip all html tags that may have been added through the form. Read php.net on strip_tags.

Here's my code:

private function sanitizeInput() {
    foreach($_POST as &$post) {
        $post = $this -> db -> real_escape_string($post);
    }
}

Answer 1

The code you have makes your input safe to insert into a database. However, what is safe for a database may not be safe for HTML.

Typically, you shoud use that function to insert the data, and when you retrieve it later you run it through something like htmlspecialchars before outputting it. However, do NOT do this before saving the data, only do it at the final output stage.