## 3 Methodology
### XSS Triggering in Source Code
For example, the function _filter_var_ is a filter function commonly used by developers. It can match the specified content through specific expressions. The regular replacement represented by the function _preg_replace_ is also a common method to remove XSS vulnerabilities. Such functions are called filtering functions. Analyzing these functions in the code can further audit the effectiveness of the filtering process. 3. **Type conversion**: In the major of cases, the program expects user input to be specific datatype to ensure its safety. Thus, function like _intval_ will be used to compulsorily receive a numeric. However, using this method to force data type conversion of input may drop appropriate input, which is similar to a whitelist strategy. **Depth-first function scanning algorithm**: To process a function call chain with multiple layers, this algorithm follows the depth-first strategy and scans every function in the chain recursively. The algorithm is described as follows. This Algorithm 2 can effectively reduce the function blocks involved in the analysis in the PHP code when processing deep-level function call chains, which increases the information density of the final input sequence. Therefore, we can acquire a simplified and optimized opcode list. ```
input :block is a function block in internal representation output :seq is the tokens sequence
1 is\(\_filter\gets false\);
2 ifisFilter(block)then
3 is\(\_filter\gets true\)
4 end if
5 foreach\(line\in block\)do
6 ifis\(\_filter\)then
7 /* tokenize(line) transforms the line in internal representation to token */
8 \(seq\gets seq+\texttt{tokenize}\)(line)
9 end if
10 ifline invokes a function callthen
11 jumps to new function block;
12 scan(new\(\_block,seq\))
13 end if
14
15 end for
```
**Algorithm 2**scan(\(block,seq\)). ### Proposed Theory of Sink Identification

The effects of filter-sink source code sequence can be divided into three situations:

1. User input is output without any filtering. This is the most likely scenario to trigger an XSS vulnerability. 2. User input is filtered to some extent, but the filtering is insufficient or the filtering function is used incorrectly. Sometimes this approach can prevent part of the XSS attacks, but if the attacker uses an advanced bypass method, it can bypass the restriction of filter function and trigger XSS vulnerability. 3. The code fully considers all the filtering conditions of the relevant output and sets excessively strict filtering functions. In this case, it is impossible for an attacker to trigger an XSS vulnerability. However, this kind of situation is very rare in real web applications. The most ideal way is to use corresponding effective filter functions for various sink types in the code of the program. The research of this paper focuses on the second type, that is, we expect to establish the relationship between various types of filters and sink, and evaluate the defense ability of these pairs against XSS. In Section 3.2, we extract all kinds of filter functions through the scanning algorithm in the rewritten VLD tool. The types of sink are also varied Listing 2 shows several example of sink. However, due to the characteristics of the VLD tool itself, it does not contain the relevant content of the output location. Only an echo type function call symbol as its analysis result. In the analysis of the XSS trigger process, the location of page where the contaminated data will be output is an important factor, so this condition limits our research. In the study by [PERSON] et al., the sinks were coarsely classified into 16 types. However, the granularity and accuracy of this manual identification are yet to be evaluated. Thus, we proposed a new filtering algorithm for classifying sinks.