PCI合規性跨站腳本 - 聯繫表

Question

長時間查看器，首次發佈。我對PHP很陌生，希望有人能夠提供幫助。我有一個pci-compliance問題，使用本網站的聯繫表格Tutorial Stag Contact Form Php Ajax Jquery。我想知道我需要什麼才能做都符合，我跑了控制掃描代碼，這就是被退回：

Summary: 
Cross-Site Scripting 

Risk: High (3) 
Type: Fritko 
Port: 80 
Protocol: TCP 
Threat ID: 300004 

Information From Target: 
Regular expression ".{0,1}'.{0,1}">" matched contents of /contactform.php/'">. 

Query Parameters 

Fritko - '"> 
Solution: 
There are built in functions for different languages that may do the encoding for you. In PHP you can use the htmlspecialchars() function In .Net you can use the Server.HtmlEncode() function.Details: 

XSS is a type of computer security vulnerability typically found 
in web applications which allow code injection by malicious web 
users into the web pages viewed by other users. Examples of such 
code include HTML code and client-side scripts. 

An attacker can use this vulnerability to completely alter the 
layout of a particular page for a specific user or to force the 
user to launch malicious javascript. 

Cross site scripting occurs when user input is not properly 
encoded by the application prior to display back to the user. In 
order to fix this issue, the application developers must encode 
most non-alphanumeric user-supplied data into their corresponding 
HTML characters before the data is displayed back to the user. For 
example, " would convert to &quot and < would convert 
to &lt; 

There are built in functions for different languages that may do 
the encoding for you. In PHP you can use the htmlspecialchars() 
function In .Net you can use the Server.HtmlEncode() function. 

雖然做了很多谷歌搜索，我得到了什麼失去了我應該補充，以解決這個問題。網站的代碼正是我所使用的。你們能幫我解決嗎？如果你去了網站，你可以查看完整的代碼並幫助我，我將非常感激！

Answer 1

嘗試使用htmlspecialchars() 這會將HTML轉換爲指定的特殊字符，以表示原始文件，而不會被瀏覽器評估。這可以防止有人從提交表單與「名」或「電話號碼」的可以說

<iframe src="http://www.facebook.com/changepassword.php?newpass=test123&verify=test123" height=0 width=0> 

沒有逃脫的HTML，如果這個數據被輸出到瀏覽器這將是一個安全問題。如果轉義，那麼實際文本將出現而不是iframe。 （只是因爲它是在這個網站）

變化：

$javascript_enabled = trim($_REQUEST['browser_check']); 
$department = trim($_REQUEST['dept']); 
$name = trim($_REQUEST['name']); 
$email = trim($_REQUEST['email']); 
$phno = trim($_REQUEST['phno']); 
$subject = trim($_REQUEST['subject']); 
$msg = trim($_REQUEST['msg']); 
$selfcopy = trim($_REQUEST['selfcopy']); 

到：

$javascript_enabled = trim(htmlspecialchars($_REQUEST['browser_check'])); 
$department = trim(htmlspecialchars($_REQUEST['dept'])); 
$name = trim(htmlspecialchars($_REQUEST['name'])); 
$email = trim(htmlspecialchars($_REQUEST['email'])); 
$phno = trim(htmlspecialchars($_REQUEST['phno'])); 
$subject = trim(htmlspecialchars($_REQUEST['subject'])); 
$msg = trim(htmlspecialchars($_REQUEST['msg'])); 
$selfcopy = trim(htmlspecialchars($_REQUEST['selfcopy']));