关于xss过滤后的数据传递问题

[it民工甲]

最近手头在做一个asp老系统的xss脆弱性对应。 暂定的对应方案是，在服务器端把特殊字符转义在返回客户端浏览器，比如:< 转义为 < 。但遇到了一个问题，请各位大神赐教。 设计的时候是准备在服务器端加两个方法， 方法一，把客户端传来的参数里包含的特殊字符转义传回客户端。 方法二，把客户端传回服务器端准备存DB的数据中包含的转义字符转回本来的样子，在进行半角变全角无害化之后存库。 实际运用中发现，方法一达到预期效果，但方法二好像没有必要，好像客户端传回服务器的参数中如果包含了转义字符，在服务器端解析取值的时候会变成转义前的样子。 想找一些理论依据但始终没找到，请问各位大神，包含转义字符的参数值post回服务器后，转义字符变回原来的样子是浏览器还是服务器的功能？主流的浏览器都是这样吗？

[it民工甲]

引用 1 楼 csdn_aspnet的回复:

不管哪端 做好转换就可以了 Function HtmlDecode(ByVal s) If Has(s) Then s = regReplace(s, "<br\s*/?\s*>", vbCrLf) s = Replace(s, "    ", Chr(9)) s = Replace(s, """, Chr(34)) s = Replace(s, " ", Chr(32)) s = Replace(s, "'", Chr(39)) s = Replace(s, "'", Chr(39)) s = Replace(s, ">", ">") s = Replace(s, "<", "<") s = Replace(s, "&", Chr(38)) s = Replace(s, "&", Chr(38)) s = Replace(s, "×", "×") s = Replace(s, "÷", "÷") s = Replace(s, "¼", "¼") s = Replace(s, "½", "½") s = Replace(s, "¾", "¾") s = Replace(s, "±", "±") s = Replace(s, "«", "«") s = Replace(s, "»", "»") s = Replace(s, "©", "©") s = Replace(s, "®", "®") s = Replace(s, "°", "°") End If HtmlDecode = s End Function

谢谢回答，不过这个转换我觉得还是要在服务器端做，因为客户端js转换和check是可以用拦截器绕过去直接修改提交给服务器的数据的，我们这个系统也是被这种鉴定部门绕过js植入的代码。

[csdn_aspnet]

不管哪端 做好转换就可以了 Function HtmlDecode(ByVal s) If Has(s) Then s = regReplace(s, "<br\s*/?\s*>", vbCrLf) s = Replace(s, "    ", Chr(9)) s = Replace(s, """, Chr(34)) s = Replace(s, " ", Chr(32)) s = Replace(s, "'", Chr(39)) s = Replace(s, "'", Chr(39)) s = Replace(s, ">", ">") s = Replace(s, "<", "<") s = Replace(s, "&", Chr(38)) s = Replace(s, "&", Chr(38)) s = Replace(s, "×", "×") s = Replace(s, "÷", "÷") s = Replace(s, "¼", "¼") s = Replace(s, "½", "½") s = Replace(s, "¾", "¾") s = Replace(s, "±", "±") s = Replace(s, "«", "«") s = Replace(s, "»", "»") s = Replace(s, "©", "©") s = Replace(s, "®", "®") s = Replace(s, "°", "°") End If HtmlDecode = s End Function

[大瓶药水]

用HTMLEncode

[brotherq]

浏览器的功能。

[浴火_凤凰]

防御XSS： 一句话送给楼主： 输入过滤，输出编码