使用 PHP 防止用户代理恶意代码

Question

我有这个 PHP 代码，用于 Wordpress 插件。如何防止用户代理恶意代码注入？我加了

if (preg_match('/script/',$agent)) {
$agent = preg_replace('#<script(.*?)>(.*?)</script>#is', '', $agent);

仅用于防止 javascript 恶意代码，但不足以防止其他攻击。有人建议我在显示 html 实体时对它们进行编码，但我不知道该怎么做。有人可以帮助我吗？

<?php       
    class Browser{

        public $Name = "Unknown";
        public $Version = "";
        public $Platform = "Unknown";
        public $Pver = "";
        public $Agent = "Not reported";
        public $AOL = false;
        public $Image = "";
        public $Architecture = "";

        public function Browser($agent){

            // initialize properties
            $bd['platform'] = "Unknown";
            $bd['pver'] = "";
            $bd['browser'] = "Unknown";
            $bd['version'] = "";
            $this->Agent = $agent;

            // echo $agent;

            // fl3r: previene hack da iniezione codice nello user agent

            if (preg_match('/script/',$agent)) {
            $agent = preg_replace('#<script(.*?)>(.*?)</script>#is', '', $agent);
            $bd['platform'] = "Defended";
            $bd['browser'] = "Defended";
            $agent = 'Defended';

            }

            // fl3r: sistemi operativi

            if (stripos($agent,'win'))
            {
                $bd['platform'] = "Windows";
                if(stripos($agent,'Windows 3.1'))
                    $val = '3.1';
                elseif(stripos($agent,'Win16'))
                    $val = '3.11';
                elseif(stripos($agent,'Windows 95'))
                    $val = '95';
                elseif(stripos($agent,'Win95'))
                    $val = '95';
                elseif(stripos($agent,'Windows_95'))
                    $val = '95';
                elseif(stripos($agent,'Windows 98'))
                    $val = '98';
                elseif(stripos($agent,'Win98'))
                    $val = '98';
                elseif(stripos($agent,'Windows ME'))
                    $val = 'ME';
                elseif(stripos($agent,'Windows NT 4.0'))
                    $val = 'NT';
                elseif(stripos($agent,'WinNT4.0'))
                    $val = 'NT';
                elseif(stripos($agent,'WinNT'))
                    $val = 'NT';
                //elseif(stripos($agent,'Windows NT'))
                    //$val = 'NT';
                elseif(stripos($agent,'Windows 2000'))
                    $val = '2000';
                elseif(stripos($agent,'Windows NT 5.1'))
                    $val = 'XP';
                elseif(stripos($agent,'Windows XP'))
                    $val = 'XP';
                elseif(stripos($agent,'Windows NT 5.2'))
                    $val = 'Server 2003';
                elseif(stripos($agent,'NT 5.2'))
                    $val = 'Server 2003';
                elseif(stripos($agent,'Windows NT 6.0'))
                    $val = 'Vista';
                elseif(stripos($agent,'Windows NT 6.1'))
                    $val = '7';
                elseif(stripos($agent,'Windows NT 6.2'))
                    $val = '8';
                elseif(stripos($agent,'Windows NT 6.3'))
                    $val = '8.1';
                elseif(stripos($agent,'Windows NT 6.4'))
                    $val = '10';
            elseif(stripos($agent,'Windows CE'))
                $val = 'CE';
            elseif(stripos($agent,'Windows CE 5.1'))
                $val = 'CE';
            elseif(stripos($agent,'WCE'))
                $val = 'Mobile';
            elseif(stripos($agent,'Windows Mobile'))
                $val = 'Mobile';
            elseif(stripos($agent,'Windows Phone'))
                $val = 'Phone';
                $bd['pver'] = $val;
            }

            // ios (os e browser)           
            elseif(preg_match('/iPad/i', $agent)){
                $bd['browser']= 'Safari';
                $bd['platform']="iPad";
                if(preg_match('/CPU\ OS\ ([._0-9a-zA-Z]+)/i', $agent, $regmatch))
                    $bd['pver']=" iOS ".str_replace("_", ".", $regmatch[1]);
            }elseif(preg_match('/iPod/i', $agent)){
                $bd['browser']= 'Safari';
                $bd['platform']="iPod";
                if(preg_match('/iPhone\ OS\ ([._0-9a-zA-Z]+)/i', $agent, $regmatch))
                    $bd['pver']=" iOS ".str_replace("_", ".", $regmatch[1]);
            }elseif(preg_match('/iPhone/i', $agent)){
                $bd['browser']= 'Safari';
                $bd['platform']="iPhone";
                if(preg_match('/iPhone\ OS\ ([._0-9a-zA-Z]+)/i', $agent, $regmatch))
                    $bd['pver']=" iOS ".str_replace("_", ".", $regmatch[1]);
            }

// 其他代码在这里
//////////////////////////////////////////////// ///////////////////////////

            // architettura x86/x64
            if(stripos($agent,'x86_64')) {
                $bd['architecture'] = "x86_64";
            }

            // fl3r: assegna le varie proprietà
            $this->Name = $bd['browser'];
            $this->Version = $bd['version'];
            $this->Platform = $bd['platform'];
            $this->Pver = $bd['pver'];
            $this->AOL = $bd['aol'];
            $this->Architecture = $bd['architecture'];
            $this->Architecture = $bd['architecture'];


            // fl3r: assegna immagini browser

            $this->BrowserImage = strtolower($this->Name);
            if($this->BrowserImage == "msie")
                $this->BrowserImage .=  '-'.$this->Version;

            // snoopy
            elseif(stripos($this->BrowserImage, "snoopy") === 0)
                $this->BrowserImage = 'other';


            // fl3r: assegna immagini os

            $this->PlatformImage = strtolower($this->Platform);

            if($this->PlatformImage == "linux mint")
                $this->PlatformImage = "linux-mint";
            if($this->PlatformImage == "fedora ")
                $this->PlatformImage = "fedora";    
            if($this->PlatformImage == "windows")
                $this->PlatformImage .=  '-'.strtolower($this->Pver);

        }
    }
?>

Answer 1

完全相同的方式你应该已经防止注入所有其他值。它具体是一个用户代理字符串是无关紧要的。将其写入 HTML 页面时，通过 htmlspecialchars 传递它：echo htmlspecialchars($user_agent);。将其用作数据库查询的一部分时，请使用准备好的语句或数据库 API 为您提供的任何转义函数。

使用 PHP 防止用户代理恶意代码

Prevent User Agent malicious code with PHP

php

security

wordpress

user-agent