php+js xss

imageXss.js

/* 
 * src="javascript:alert(1)"
 * src="jav ascript:alert(2)"
 * src="java&#x0script:alert(3)"
 * src="&#000 ……."
 * src="上面4中的变种“
 */

// php 检测以上 4 种 xss 
function imageXSS($img) {
    return preg_match('/(?:javascript|jav\s+ascript|\&#\d+|\&#x)/i', $img);
}

// 用 js 解决外部链接 url 问题
~function ($) {
    $.fn.imageXSS = function () {
        this.each(function () {
            var that = $(this),
                url = that.data('mdimg'),
                img = document.createElement('img');
            $(img).on('load', function () {
                that.attr('src', url);
            })
            $(img).on('error', function () {
                that.attr('src', 'image/url/on/your/site/');
            })

            img.src = url;
        })
    }
    $('[data-mdimg]').imageXSS();
}(jQuery)