Commit 9fd25fa5 authored by Dries's avatar Dries

- Some more refinements

parent c89f78aa
......@@ -483,9 +483,13 @@ function xss_check_input_data($data) {
** Detect evil input data.
*/
// check strings:
$match += preg_match("/\Wjavascript\s*:/i", $data);
$match += preg_match("/\Wexpression\s*\(/i", $data);
$match += preg_match("/\Walert\s*\(/i", $data);
// check attributes:
$match = preg_match("/\W(dynsrc|datasrc|data|lowsrc|on[a-z]+)\s*=[^>]+?>/i", $data);
$match += preg_match("/\Wjavascript\s*:/i", $data);
// check tags:
$match += preg_match("/<\s*(applet|script|object|style|embed|form|blink|meta|html|frame|iframe|layer|ilayer|head|frameset|xml)/i", $data);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment