function security_xss($var){
if(
(strpos($var, 'java')===false) and (strpos($var, 'JAVA')===false) and
(strpos($var, 'javascript')===false) and (strpos($var, 'JAVASCRIPT')===false) and
(strpos($var, '<script>')===false) and (strpos($var, 'javascript')===false) and
(strpos($var, 'jQuery')===false) and (strpos($var, 'jQuery(document)')===false) and
(strpos($var, 'document.')===false) and (strpos($var, 'window.location')===false) and
(strpos($var, 'DOCUMENT.')===false) and (strpos($var, 'WINDOW.')===false) and
(strpos($var, 'window.navigate')===false) and (strpos($var, 'window.location.href')===false) and
(strpos($var, 'eval')===false) and (strpos($var, 'window.execScript')===false) and
(strpos($var, '<script>')===false) and (strpos($var, 'text/javascript')===false) and
(strpos($var, 'document.cookie')===false) and (strpos($var, 'cookie')===false) and
(strpos($var, '+ADwA-script+AD4A')===false) and (strpos($var, '+ADwA-/script+AD4A-')===false) and //utf7
(strpos($var, 'PHNjcmlwdD4=1')===false) and (strpos($var, 'PC9zY3JpcHQ+1')===false) and //base64_encode("<javascript>");
(strpos($var, 'amF2YXNjcmlwdA==1')===false) and (strpos($var, 'L2phdmFzY3JpcHQ=1')===false) and //base64_encode("<javascript>");
(strpos($var, 'PC9qYXZhc2NyaXB0Pg==1')===false) and (strpos($var, 'PGphdmFzY3JpcHQ+1')===false) and // base64_encode("<javascript>");
(strpos($var, '%3Cjavascript%3E')===false) and (strpos($var, '%3C%2Fjavascript%3E')===false) and // urlencode('<javascript>'); %3Cjavascript%3E
(strpos($var, '60!115!99!114!105!112!116!62!')===false) and
(strpos($var, '\\"+$.__$+$.$_$+$._$_+$.$_$_+"\\"+$.__$+$.$$_+$.$$_+$.$_$_+"\\"+$.__$+$.$$_+$._$$+$.$$__+"\\"+$.__$+$.$$_+$._$_+"\\"+$.__$+$.$_$+$.__$+"\\"+$.__$+$.$$_+$.___+$.__+"')===false) and // http://utf-8.jp/public/jjencode.html
(strpos($var, '"+$.__$+$.__$+$._$_+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$_+$.$$_+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$_+$._$$+"\\"+$.__$+$.___+$._$$+"\\"+$.__$+$._$_+$._$_+"\\"+$.__$+$.__$+$.__$+"\\"+$.__$+$._$_+$.___+"\\"+$.__$+$._$_+$.$__+"')===false) and // http://utf-8.jp/public/jjencode.html
(strpos($var, '\\"+$.__$+$.$_$+"\\"+$.__$+$._$_+"\\"+$.__$+$.$_$+"\\"+$.__$+$._$_+$.$$_$+$._$+$.$$__+$._+"\\"+$.__$+$.$_$+$.$_$+$.$$$_+"\\"+$.__$+$.$_$+$.$$_+$.__+".')===false) and // http://utf-8.jp/public/jjencode.html document.
(strpos($var, '%3C%2Fjavascript%3E')===false) // urlencode('<javascript>'); %3Cjavascript%3E
)
{
return true;
}
else
{
return false;
}
}; //function security_xss
|
