Cross-Site Scripting Phishing Through Frames

Question

how we can protect a website from "Cross-Site Scripting Phishing Through Frames" by php..

thanks

Answer 1

The following script can help:

<script type="text/javascript">
    if(top.frames.length > 0) {
        top.location.href = self.location;
    }
</script> 

If you include this in each of your pages, then you're basically checking that there aren't multiple frames on the top page. Obviously it only works if your site doesn't itself use iframes (for example, for serving ads).

However, the best defence against phishing scams is to:

1. Never ever send users emails with links back to your site, asking them to log on.
2. Educate your users about policy #1 above (i.e. tell them, "We will never send you emails asking you to log onto the site, if you have any problems with your account please call us on xxx").
3. Make it easy for your users to report phishing scams to you. Have a prominent link on your home page, and work with the ISP of offending sites to get them shut down as soon as possible.

Answer 2

Cross site Scripting mostly occurred via url

Like http://www.example.com/index.php?q="><script>alert('SSS')</script>

If your index.php page contain

echo $_GET['q'];

You will receive a alert. So that user can grab your cookies also insert malicious code into your web. So make sure you are using all GET and POST variable with validation.