Pci 合规性跨站点脚本 - 联系表

Question

长期观看，第一次发帖。我是 php 新手，希望有人能提供帮助。我使用此网站上的联系表格Tutorial Stag Contact Form Php Ajax Jquery 遇到了 pci 合规问题。我想知道我需要做什么才能合规，我用控制扫描运行了代码，这就是返回的内容：

Summary: 
Cross-Site Scripting

Risk: High (3)
Type: Fritko
Port: 80
Protocol: TCP
Threat ID: 300004

Information From Target:
Regular expression ".{0,1}'.{0,1}">" matched contents of /contactform.php/'">.

Query Parameters

Fritko - '">
Solution:
There are built in functions for different languages that may do the encoding for you. In PHP you can use the htmlspecialchars() function In .Net you can use the Server.HtmlEncode() function.Details:

XSS is a type of computer security vulnerability typically found 
in web applications which allow code injection by malicious web 
users into the web pages viewed by other users. Examples of such 
code include HTML code and client-side scripts. 

An attacker can use this vulnerability to completely alter the 
layout of a particular page for a specific user or to force the 
user to launch malicious javascript. 

Cross site scripting occurs when user input is not properly 
encoded by the application prior to display back to the user. In 
order to fix this issue, the application developers must encode 
most non-alphanumeric user-supplied data into their corresponding 
HTML characters before the data is displayed back to the user. For 
example, " would convert to &quot and < would convert 
to &lt; 

There are built in functions for different languages that may do 
the encoding for you. In PHP you can use the htmlspecialchars() 
function In .Net you can use the Server.HtmlEncode() function. 

在进行大量谷歌搜索时，我迷失了应该添加什么来解决问题。网站上的代码正是我使用的。你们能帮我解决这个问题吗？如果您访问该网站，您将能够查看完整的代码并帮助我，我将不胜感激！

Answer 1

尝试使用htmlspecialchars() 这会将 HTML 转换为指定用于表示原始内容的特殊字符，而无需浏览器评估。这可以防止某人提交带有“姓名”或“电话号码”的表单，比如

<iframe src="http://www.facebook.com/changepassword.php?newpass=test123&verify=test123" height=0 width=0>

如果不转义 HTML，如果将此数据输出到浏览器将是一个安全问题。如果转义，则将显示实际文本而不是 iframe。 （就像在这个网站上一样）

变化：

$javascript_enabled = trim($_REQUEST['browser_check']);   
$department = trim($_REQUEST['dept']);   
$name = trim($_REQUEST['name']);   
$email = trim($_REQUEST['email']);   
$phno = trim($_REQUEST['phno']);   
$subject = trim($_REQUEST['subject']);   
$msg = trim($_REQUEST['msg']);   
$selfcopy = trim($_REQUEST['selfcopy']);

到：

$javascript_enabled = trim(htmlspecialchars($_REQUEST['browser_check']));   
$department = trim(htmlspecialchars($_REQUEST['dept']));   
$name = trim(htmlspecialchars($_REQUEST['name']));   
$email = trim(htmlspecialchars($_REQUEST['email']));   
$phno = trim(htmlspecialchars($_REQUEST['phno']));   
$subject = trim(htmlspecialchars($_REQUEST['subject']));   
$msg = trim(htmlspecialchars($_REQUEST['msg']));   
$selfcopy = trim(htmlspecialchars($_REQUEST['selfcopy']));