php xss过滤

    <?php /**     * @去除XSS（跨站脚本攻击）的函数     * @par $val 字符串参数，可能包含恶意的脚本代码如<script language="javascript">alert("hello world");     * @return  处理后的字符串     * @Recoded By Androidyue     **/      function RemoveXSS($val) {           // remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed           // this prevents some character re-spacing such as <java>           // note that you have to handle splits with \n, \r, and \t later since they *are* allowed in some inputs           $val = preg_replace('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/', '', $val);                  // straight replacements, the user should never need these since they're normal characters           // this prevents like <img  src="@avascript:alert('XSS')" alt="php xss过滤" >           $search = 'abcdefghijklmnopqrstuvwxyz';          $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';           $search .= '1234567890!@#$%^&*()';          $search .= '~`";:?+/={}[]-_|\'\\';          for ($i = 0; $i  0) {                      $pattern .= '(';                       $pattern .= '([xX]0{0,8}([9ab]);)';                      $pattern .= '|';                       $pattern .= '|(?{0,8}([9|10|13]);)';                      $pattern .= ')*';                   }                   $pattern .= $ra[$i][$j];                }                $pattern .= '/i';                 $replacement = substr($ra[$i], 0, 2).'<x>'.substr($ra[$i], 2); // add in  to nerf the tag                 $val = preg_replace($pattern, $replacement, $val); // filter out the hex tags                 if ($val_before == $val) {                    // no replacements were made, so exit the loop                    $found = false;                 }              }           }           return $val;        }      //测试一下效果      //echo RemoveXSS("<script language="javascript">alert('hello world');</script>") ;      ?>  </x></java>