摘要：防止跨站腳本攻擊的方法是針對非法的代碼包括單雙引號等，使用函數。和這兩個函數對之類的字符串支持不好都不能轉化所以用和轉化的字符串只能防止攻擊不能防止注入攻擊所有有打印的語句如，等在打印前都要使用進行過濾，這樣可以防止，注意中文要寫出。

PHP防止XSS跨站腳本攻擊的方法:是針對非法的HTML代碼包括單雙引號等，使用htmlspecialchars()函數 。

在使用htmlspecialchars()函數的時候注意第二個參數, 直接用htmlspecialchars($string) 的話,第二個參數默認是ENT_COMPAT,函數默認只是轉化雙引號(“), 不對單引號(‘)做轉義.

所以,htmlspecialchars函數更多的時候要加上第二個參數, 應該這樣用: htmlspecialchars($string,ENT_QUOTES).當然,如果需要不轉化如何的引號,用htmlspecialchars($string,ENT_NOQUOTES).

另外, 盡量少用htmlentities, 在全部英文的時候htmlentities和htmlspecialchars沒有區別,都可以達到目的.但是,中文情況下, htmlentities卻會轉化所有的html代碼，連同里面的它無法識別的中文字符也給轉化了。

htmlentities和htmlspecialchars這兩個函數對 "之類的字符串支持不好,都不能轉化, 所以用htmlentities和htmlspecialchars轉化的字符串只能防止XSS攻擊,不能防止SQL注入攻擊.

所有有打印的語句如echo，print等 在打印前都要使用htmlentities() 進行過濾，這樣可以防止Xss，注意中文要寫出htmlentities($name,ENT_NOQUOTES,GB2312) 。

(1).網頁不停地刷新 ""

(2).嵌入其它網站的鏈接 除了通過正常途徑輸入XSS攻擊字符外，還可以繞過JavaScript校驗，通過修改請求達到XSS攻擊的目的.

 $value) 
     {
        if (!is_array($value))
        {
          if (!get_magic_quotes_gpc())  //不對magic_quotes_gpc轉義過的字符使用addslashes(),避免雙重轉義。
          {
             $value  = addslashes($value); //給單引號（"）、雙引號（"）、反斜線（）與 NUL（NULL 字符）
             加上反斜線轉義
          }
          $value       = preg_replace($ra,"",$value);     //刪除非打印字符，粗暴式過濾xss可疑字符串
          $arr[$key]     = htmlentities(strip_tags($value)); //去除 HTML 和 PHP 標記并轉換為 HTML 實體
        }
        else
        {
          SafeFilter($arr[$key]);
        }
     }
   }
}
?>
$str = "www.90boke.com";
SafeFilter ($str); //如果你把這個注釋掉，提交之后就會無休止刷新
echo $str;

//------------------------------php防注入和XSS攻擊通用過濾-----Start--------------------------------------------//
function string_remove_xss($html) {
    preg_match_all("/<([^<]+)>/is", $html, $ms);
 
    $searchs[] = "<";
    $replaces[] = "<";
    $searchs[] = ">";
    $replaces[] = ">";
 
    if ($ms[1]) {
        $allowtags = "img|a|font|div|table|tbody|caption|tr|td|th|br|p|b|strong|i|u|em|span|ol|ul|li|blockquote";
        $ms[1] = array_unique($ms[1]);
        foreach ($ms[1] as $value) {
            $searchs[] = "<".$value.">";
 
            $value = str_replace("&", "_uch_tmp_str_", $value);
            $value = string_htmlspecialchars($value);
            $value = str_replace("_uch_tmp_str_", "&", $value);
 
            $value = str_replace(array("", "/*"), array(".", "/."), $value);
            $skipkeys = array("onabort","onactivate","onafterprint","onafterupdate","onbeforeactivate","onbeforecopy","onbeforecut","onbeforedeactivate",
                    "onbeforeeditfocus","onbeforepaste","onbeforeprint","onbeforeunload","onbeforeupdate","onblur","onbounce","oncellchange","onchange",
                    "onclick","oncontextmenu","oncontrolselect","oncopy","oncut","ondataavailable","ondatasetchanged","ondatasetcomplete","ondblclick",
                    "ondeactivate","ondrag","ondragend","ondragenter","ondragleave","ondragover","ondragstart","ondrop","onerror","onerrorupdate",
                    "onfilterchange","onfinish","onfocus","onfocusin","onfocusout","onhelp","onkeydown","onkeypress","onkeyup","onlayoutcomplete",
                    "onload","onlosecapture","onmousedown","onmouseenter","onmouseleave","onmousemove","onmouseout","onmouseover","onmouseup","onmousewheel",
                    "onmove","onmoveend","onmovestart","onpaste","onpropertychange","onreadystatechange","onreset","onresize","onresizeend","onresizestart",
                    "onrowenter","onrowexit","onrowsdelete","onrowsinserted","onscroll","onselect","onselectionchange","onselectstart","onstart","onstop",
                    "onsubmit","onunload","javascript","script","eval","behaviour","expression","style","class");
            $skipstr = implode("|", $skipkeys);
            $value = preg_replace(array("/($skipstr)/i"), ".", $value);
            if (!preg_match("/^[/|s]?($allowtags)(s+|$)/is", $value)) {
                $value = "";
            }
            $replaces[] = empty($value) ? "" : "<" . str_replace(""", """, $value) . ">";
        }
    }
    $html = str_replace($searchs, $replaces, $html);
 
    return $html;
}
//php防注入和XSS攻擊通用過濾 
function string_htmlspecialchars($string, $flags = null) {
    if (is_array($string)) {
        foreach ($string as $key => $val) {
            $string[$key] = string_htmlspecialchars($val, $flags);
        }
    } else {
        if ($flags === null) {
            $string = str_replace(array("&", """, "<", ">"), array("&", """, "<", ">"), $string);
            if (strpos($string, "&#") !== false) {
                $string = preg_replace("/&((#(d{3,5}|x[a-fA-F0-9]{4}));)/", "&1", $string);
            }
        } else {
            if (PHP_VERSION < "5.4.0") {
                $string = htmlspecialchars($string, $flags);
            } else {
                if (!defined("CHARSET") || (strtolower(CHARSET) == "utf-8")) {
                    $charset = "UTF-8";
                } else {
                    $charset = "ISO-8859-1";
                }
                $string = htmlspecialchars($string, $flags, $charset);
            }
        }
    }
 
    return $string;
}
//------------------php防注入和XSS攻擊通用過濾-----End--------------------------------------------//

PHP中的設置
PHP5.2以上版本已支持HttpOnly參數的設置，同樣也支持全局的HttpOnly的設置，在php.ini中

----------------------------------------------------- 
 session.cookie_httponly = 
-----------------------------------------------------

設置其值為1或者TRUE，來開啟全局的Cookie的HttpOnly屬性，當然也支持在代碼中來開啟：

Cookie操作函數setcookie函數和setrawcookie函數也專門添加了第7個參數來做為HttpOnly的選項，開啟方法為：

老版本的PHP就不說了。沒企業用了吧。