我们对我们的 PHP 代码进行了安全审查，安全公司在他们的报告中发送了这个：
要求
GET /appdir/ajax/addAvail.php?counter=1216%3cscript%3ealert(0)%3c%2fscript%3e&from=1216%3cscript%3ealert(0)%3c%2fscript%3e&to=1216%3cscript%3ealert(0)%3c%2fscript%3e&day=1216%3cscript%3ealert(0)%3c%2fscript%3e&parentDiv=1216%3cscript%3ealert(0)%3c%2fscript%3e&type=1216%3cscript%3ealert(0)%3c%2fscript%3e&date=1216%3cscript%3ealert(0)%3c%2fscript%3e&showdate=1216%3cscript%3ealert(0)%3c%2fscript%3e
HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
User-Agent: x
Content-Length: 0
Cache-Control: max-age=0
Origin: null
Accept: text/html
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
回复
HTTP/1.1 200 OK
Date: Fri, 17 Dec 2010 00:46:48 GMT
Server: Apache/2.2.14 (Win32) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.8l mod_autoindex_color PHP/5.3.1 mod_apreq2-20090110/2.7.1 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.1
Set-Cookie: PHPSESSID=q832q9c0ftdsat8r55dg32taf7; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 928
Content-Type: text/html
<div class="time_row" id="days_time_container1216<script>alert(0)</script>">
<div class="day_holder">1216<script>alert(0)</script></div>
<div class="time_holder">1216<script>alert(0)</script> <span>-</span> 1216<script>alert(0)</script></div>
<div class="button_holder"><a href="javascript:void(0);" onClick="removeElement('1216<script>alert(0)</script>','days_time_container1216<script>alert(0)</script>','decrementDays')" class="link4">Remove</a></div>
<div class="clear"></div>
<input type="hidden" id="hday1216<script>alert(0)</script>" name="hday1216<script>alert(0)</script>" value="1216<script>alert(0)</script>">
<input type="hidden" id="hfrom11216<script>alert(0)</script>" name="hfrom11216<script>alert(0)</script>" value="1216<script>alert(0)</script>">
<input type="hidden" id="hto11216<script>alert(0)</script>" name="hto11216<script>alert(0)</script>" value="1216<script>alert(0)</script>">
</div>
如果我通过 FireFox 直接访问脚本（FireBug 报告的标题）
/appdir/ajax/addAvail.php
HTTP/1.1 200 OK
Date: Sat, 25 Dec 2010 03:30:54 GMT
Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4
X-Powered-By: PHP/5.3.2
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, private, no-cache, no-store, proxy-revalidate, no-transform
Pragma: no-cache, no-cache
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 253
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
<div class="time_row" id="days_time_container">
<div class="day_holder"></div>
<div class="time_holder"> <span>-</span> </div>
<div class="button_holder"><a href="javascript:void(0);" onClick="removeElement('','days_time_container','decrementDays')" class="link4">Remove</a></div>
<div class="clear"></div>
<input type="hidden" id="hday" name="hday" value="">
<input type="hidden" id="hfrom1" name="hfrom1" value="">
<input type="hidden" id="hto1" name="hto1" value="">
</div>
我试图理解为什么这可能是有问题的。当然，我会询问安全公司，但我也在尝试评估他们，看看社区在他们给我一些迂回的答案之前要说些什么。
此外，这与安全审查有关：“HTTP header user-agent has been set to (something)”，因为这两个问题都在同一份报告中发现。