Prevent XSS attacks with .htaccess

Question

如何使用XSS(cross site scripting) atacks阻止带有.htaccess文件的PHP项目？

Answer 1

You can't configure your server to magically stop XSS attacks. This is something you must do at the application layer, by escaping output properly.

Answer 2

Try this:

# Add Security Headers
<IfModule mod_headers.c>
    # Protect against XSS attacks
    Header set X-XSS-Protection "1; mode=block"
</IfModule>

• 1 : Enable XSS Protection

• mode=block : Rather than sanitizing the page, the browser will prevent rendering of the page if an attack is detected.

You can find more security related snippets here

Reference

Hope this helps

Answer 3

Try this one, it's working for me :

<IfModule mod_rewrite.c>
    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
    RewriteRule .* index.php [F,L]
</IfModule>