YII 登录模块XSS攻击

<div class="container">

        <?php $form = ActiveForm::begin([

            'id' => 'login-form',

            'options' => ['class'=>'form-signin']

        ]); ?>

        <h2 class="form-signin-heading">sign in now</h2>

        <div class="login-wrap">

            <?= $form->field($model, 'username',['labelOptions' => ['label' => '用户名']]) ?>

            <?= $form->field($model, 'password',['labelOptions' => ['label' => '密码']])->passwordInput() ?>

            <div class="ctn code">

                <label for="loginform-password">验证码</label>

                <input type="text" name="LoginForm[verifyCode]" class="form-control">

                <?= $form->field($model, 'verifyCode', [

                    'options' => ['class' => 'form-group form-group-lg'],

                ])->widget(Captcha::className(),[

                    'template' => "{image}",

                    'imageOptions' => ['alt' => '验证码'],

                    'captchaAction' => 'site/captcha',

                ]); ?>

            </div>

            <label class="checkbox">

                <label for="loginform-rememberme">

                    <input type="hidden" name="LoginForm[rememberMe]" value="0">

                    <input type="checkbox" id="loginform-rememberme" name="LoginForm[rememberMe]" value="1" checked="">

                    记住我

                </label>

            </label>



            <p class="help-block help-block-error" style="color: red"><?= Html::encode($error); ?></p>

            <?= Html::submitButton('登陆', ['class' => 'btn btn-lg btn-login btn-block', 'name' => 'login-button']) ?>