YII 登录模块XSS攻击

[一生小白]

用检测工具监测，会有xss攻击

<div class="container">
        <?php $form = ActiveForm::begin([
            'id' => 'login-form',
            'options' => ['class'=>'form-signin']
        ]); ?>
        <h2 class="form-signin-heading">sign in now</h2>
        <div class="login-wrap">
            <?= $form->field($model, 'username',['labelOptions' => ['label' => '用户名']]) ?>
            <?= $form->field($model, 'password',['labelOptions' => ['label' => '密码']])->passwordInput() ?>
            <div class="ctn code">
                <label for="loginform-password">验证码</label>
                <input type="text" name="LoginForm[verifyCode]" class="form-control">
                <?= $form->field($model, 'verifyCode', [
                    'options' => ['class' => 'form-group form-group-lg'],
                ])->widget(Captcha::className(),[
                    'template' => "{image}",
                    'imageOptions' => ['alt' => '验证码'],
                    'captchaAction' => 'site/captcha',
                ]); ?>
            </div>
            <label class="checkbox">
                <label for="loginform-rememberme">
                    <input type="hidden" name="LoginForm[rememberMe]" value="0">
                    <input type="checkbox" id="loginform-rememberme" name="LoginForm[rememberMe]" value="1" checked="">
                    记住我
                </label>
            </label>

            <p class="help-block help-block-error" style="color: red"><?= Html::encode($error); ?></p>
            <?= Html::submitButton('登陆', ['class' => 'btn btn-lg btn-login btn-block', 'name' => 'login-button']) ?>

[游北亮]

xss攻击防御还是比较简单的， 1、输入过滤，比如把尖括号替换成空，或直接htmlspecialchars后存储； 注意如果xss直接在你的js代码里，就要替换掉单引号和双引号，再用引号括起来； 2、如果输入不能过滤，比如csdn要允许代码输入，那么在所有展示用户输出的地方，都加上htmlspecialchars 3、cookie设置为HttpOnly