開始 · PHP筆記

安裝 ``` composer require ezyang/htmlpurifier ``` 調用 ``` function removeXSS($dirty_html){ require '../vendor/autoload.php'; //或者 //require_once 'library/HTMLPurifier.includes.php'; // 載入核心文件 // 生成配置對象配置文檔http://htmlpurifier.org/live/configdoc/plain.html $config = HTMLPurifier_Config::createDefault(); //設置字符集編碼 $config->set('Core.Encoding', 'UTF-8'); /** * 設置文檔類型，支持的文檔類型包括： * HTML 4.01 Strict * HTML 4.01 Transitional * XHTML 1.0 Strict * XHTML 1.0 Transitional * XHTML 1.1 */ $config->set('HTML.Doctype', 'HTML 4.01 Transitional'); //將相對URL 轉換為絕對URL $config->set('URI.Base', 'http://www.example.com'); $config->set('URI.MakeAbsolute', true); //自動分段輸入文本 $config->set('AutoFormat.AutoParagraph', true); // // // $config->set('HTML.Allowed', 'p,b,a[href],i'); //設置允許使用的HTML標簽 $config->set('HTML.Allowed','div,b,strong,i,em,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]'); // 設置允許出現的CSS樣式屬性 $config->set('CSS.AllowedProperties', 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align'); // 設置a標簽上是否允許使用target="_blank" $config->set('HTML.TargetBlank', TRUE); //緩存 //確保Serializer目錄擁有存儲權限 //chmod -R 0775 HTMLPurifier/DefinitionCache/Serializer //禁用緩存這會導致性能下降 //$ config-> set（'Core.DefinitionCache'，null）; //將緩存文件移至其他目錄 //$config->set('Cache.SerializerPath', '/home/user/absolute/path'); // // // // // // 使用配置生成過濾用的對象 $purifier = new HTMLPurifier($config); // 過濾字符串 $clean_html = $purifier->purify($dirty_html); return $clean_html; } ``` 例子2： ``` require_once 'HTMLPurifier.includes.php'; require_once 'HTMLPurifier.autoload.php'; class Resume_HtmlPurifier implements Zend_Filter_Interface{ protected $_htmlPurifier = null; public function __construct($options = null) { $config = HTMLPurifier_Config::createDefault(); $config->set('Code.Encoding', 'UTF-8'); $config->set('HTML.Doctype', 'XHTML 1.0 Transitional'); if(!is_null($options)){ foreach($options as $option){ $config->set($option[0], $option[1], $option[2]); } } $this->_htmlPurifier = new HTMLPurifier($config); } public function filter($value) { return $this->_htmlPurifier->purify($value); } } $conf=[ //允許屬性 div table tr td br元素 [ 'HTML.AllowedElements', [ 'div' => true, 'table' => true, 'tr' => true, 'td' => true, 'br' => true, ], false ], //允許屬性 class [ 'HTML.AllowedAttributes', [ 'class' => TRUE ], false ], //禁止classes如 [ 'Attr.ForbiddenClasses', [ 'resume_p' => TRUE ], false ], //去空格 ['AutoFormat.RemoveEmpty', true, false], //去nbsp ['AutoFormat.RemoveEmpty.RemoveNbsp', true, false], ['URI.Disable', true, false], ]; $p = new Resume_HtmlPurifier($conf); $puri_html = $p->filter($html); ```