javascript防止xss攻击的方法

javascript防止xss攻击的方法

前端必须要转义后 才能传到后端  后端返回前端当然也是转义过的
有些时候XSS功能不经过前端直接请求后端 那后端也要处理下 后端一般直接cleanxss就行了 不要转义 防止更彻底

比方说html标签

var HtmlUtil = {
 2     /*1.用正则表达式实现html转码*/
 3     htmlEncodeByRegExp:function (str){  
 4          var s = "";
 5          if(str.length == 0) return "";
 6          s = str.replace(/&/g,"&");
 7          s = s.replace(/</g,"&lt;");
 8          s = s.replace(/>/g,"&gt;");
 9          s = s.replace(/ /g,"&nbsp;");
10          s = s.replace(/\'/g,"&#39;");
11          s = s.replace(/\"/g,"&quot;");
12          return s;  
13    },
14    /*2.用正则表达式实现html解码*/
15    htmlDecodeByRegExp:function (str){  
16          var s = "";
17          if(str.length == 0) return "";
18          s = str.replace(/&amp;/g,"&");
19          s = s.replace(/&lt;/g,"<");
20          s = s.replace(/&gt;/g,">");
21          s = s.replace(/&nbsp;/g," ");
22          s = s.replace(/&#39;/g,"\'");
23          s = s.replace(/&quot;/g,"\"");
24          return s;  
25    }
26 };