xss problems sloved over lol

[subzero]

type 1

if(preg_match("(<|>|%|;|<a|<img|<script|<script>|")", $text)) 
{  
$text = "Illegal tags used!";  
}

type 2

function xss($text,$subject,$action)
{
// Bad Message board 
                                                  $text = str_replace("%","%",$text);
                                                  $text = str_replace(">",">",$text);
                                                  $text = str_replace("<","&#60;",$text);
                                                  $text = str_replace("@","&#64;",$text);
                                                  $text = str_replace("£","&#163;",$text);
                                                  $text = str_replace("$","&#36;",$text);
                                                  $text = str_replace("#","&#35;",$text);
                                                  $text = str_replace("'","&#39;",$text);
                                                  $text = str_replace(",","&#44;",$text);
                                                  $text = str_replace("-","&#45;",$text);
                                                  $text = str_replace("^","&#94;",$text);
                                                  $text = str_replace("`","&#96;",$text);
                                                  $text = str_replace("{","&#123;",$text);
                                                  $text = str_replace("}","&#125;",$text);
                                                  $text = str_replace("®","&#174;",$text);
                                                  $text = str_replace("©","&#169;",$text);
                                                  $text = str_replace("§","&#167;",$text);
                                                  $text = str_replace("¨","&#168;",$text);
return html_entity_decode($text);
// Bad SubJect
                                                  $subject = str_replace("%","&#37;",$subject);
                                                  $subject = str_replace(">","&#62;",$subject);
                                                  $subject = str_replace("<","&#60;",$subject);
                                                  $subject = str_replace("@","&#64;",$subject);
                                                  $subject = str_replace("£","&#163;",$subject);
                                                  $subject = str_replace("$","&#36;",$subject);
                                                  $subject = str_replace("#","&#35;",$subject);
                                                  $subject = str_replace("'","&#39;",$subject);
                                                  $subject = str_replace(",","&#44;",$subject);
                                                  $subject = str_replace("-","&#45;",$subject);
                                                  $subject = str_replace("^","&#94;",$subject);
                                                  $subject = str_replace("`","&#96;",$subject);
                                                  $subject = str_replace("{","&#123;",$subject);
                                                  $subject = str_replace("}","&#125;",$subject);
                                                  $subject = str_replace("®","&#174;",$subject);
                                                  $subject = str_replace("©","&#169;",$subject);
                                                  $subject = str_replace("§","&#167;",$subject);
                                                  $subject = str_replace("¨","&#168;",$subject);
return html_entity_decode($subject);
// Bad Action 
                                                  $action = str_replace("%","&#37;",$action);
                                                  $action = str_replace(">","&#62;",$action);
                                                  $action = str_replace("<","&#60;",$action);
                                                  $action = str_replace("@","&#64;",$action);
                                                  $action = str_replace("£","&#163;",$action);
                                                  $action = str_replace("$","&#36;",$action);
                                                  $action = str_replace("#","&#35;",$action);
                                                  $action = str_replace("'","&#39;",$action);
                                                  $action = str_replace(",","&#44;",$action);
                                                  $action = str_replace("-","&#45;",$action);
                                                  $action = str_replace("^","&#94;",$action);
                                                  $action = str_replace("`","&#96;",$action);
                                                  $action = str_replace("{","&#123;",$action);
                                                  $action = str_replace("}","&#125;",$action);
                                                  $action = str_replace("®","&#174;",$action);
                                                  $action = str_replace("©","&#169;",$action);
                                                  $action = str_replace("§","&#167;",$action);
                                                  $action = str_replace("¨","&#168;",$action);
return html_entity_decode($action);
}

Usage !

echo xss('$_POST[text]','$_POST[subject]','$_GET[action]');

[CreativityKills]

U know using preg match is misguided coding. Could help u temporarily bt if the ha.ckers.org cheatsheet is anyfin to go by, u nid a stronger library. Theres htmlpurifier bt thats 2 slow, theres htmlawed, ur best bet. Theres also wibble, 2nd best bet.

[subzero]

Well it helps out others

[khan]

It may Helps. Use It on .htaccess

RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)chmod(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)chown(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)wget(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)cmd(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)cd%20(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)scp(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)curl(.*) [OR] 

Before this You should add (If already not added)

RewriteEngine On
RewriteBase / 

[pagal]

strip_tags and htmlspecialchars is enough to block xss.

[Jerson]

Mod rewrite are g0od

Added after 2 minutes:

I saw that c0de on dmpwap script haha. Its w0rking. strip_tags and htmlspecialchar is n0t enough

[rayjee]

tnx

tnxsubzero

[wapxtech]

pagal is right xD simple htmlspecialchars will do, no need str_replace, its for noobs

[subzero]

This does not mean your site will be 100% safe if your using htmlspecialchars !!

Most of your coding can easy bypass your htmlspecialchars('input');

Doing this str_replace does let you use (!@($!@(!@&*#(@!)* with html friendly code so users can still use chapters if your forum ! Most htmlspecialchars don't do all chapters right way !!