Is the following PHP code XSS proof?
<?php$site = $_GET["url"];echo "<a href='".str_replace(array("\"", "'", "javascript:", "vbscript:"), array("%22", "%27", "", ""), $site)."'>Site</a>";?>
Aucun commentaire:
Enregistrer un commentaire