LykanShield protection layer

XSS Injection Filter

Detect known cross-site scripting payloads in raw and encoded query strings.

Read integration guide View source on GitHub →

Overview

Rule-driven query inspection

During worm detection, LykanShield applies validated remote XSS regular expressions to the bounded request query string. A transformed match is reported as XSS_INJECT and the request is terminated before application rendering.

Request lifecycle

How it works

  1. 01

    Bound input

    The query string is limited by request_inspection_max_bytes.

  2. 02

    Apply rules

    Validated expressions from the xssinject ruleset inspect the request.

  3. 03

    Stop delivery

    Detected payloads are reported and blocked before page output.

Implementation

Technical details

  • Uses centrally maintained and validated XSS patterns.
  • Inspects the raw query string within a configurable byte limit.
  • Runs as part of lykan::worm_detect() in the standard request pipeline.
  • Also checks common exploit forms such as script tags and encoded script tags.

Request protection

<?php
lykan_config::$config['filter_active']['worm_injection'] = true;
lykan_config::$config['filter_active']['exploit'] = true;
lykan_config::$config['request_inspection_max_bytes'] = 8192;
lykan::run(__DIR__);