PHP预防XSS攻击，ajax跨域攻击的方法

function xss_clean($data){
    $data = str_replace(array('&','<','>'),array('&','<','>'),$data);
    $data = preg_replace('/(&#*w+)[x00-x20]+;/u','$1;',$data);
    $data = preg_replace('/(&#x*[0-9A-F]+);*/iu','$1;',$data);
    $data = html_entity_decode($data,ENT_COMPAT,'UTF-8');
    $data = preg_replace('#(<[^>]+?[x00-x20"'])(?:onxmlns)[^>]*+>#iu','$1>',$data);
    $data=preg_replace('#([a-z]*)[x00-x20]*=[x00-x20]*([`'"]*)[x00-x20]*j[x00-x20]*a[x00-x20]*v[x00-x20]*a[x00-x20]*s[x00-x20]*c[x00-x20]*r[x00-x20]*i[x00-x20]*p[x00-x20]*t[x00-x20]*:#iu','$1=$2nojavascript...',$data);
　　$data=preg_replace('#([a-z]*)[x00-x20]*=(['"]*)[x00-x20]*v[x00-x20]*b[x00-x20]*s[x00-x20]*c[x00-x20]*r[x00-x20]*i[x00-x20]*p[x00-x20]*t[x00-x20]*:#iu','$1=$2novbscript...',$data);
    $data=preg_replace('#([a-z]*)[x00-x20]*=(['"]*)[x00-x20]*-moz-binding[x00-x20]*:#u','$1=$2nomozbinding...',$data);
　　// Only works in IE:
　　$data=preg_replace('#(<[^>]+?)style[x00-x20]*=[x00-x20]*[`'"]*.*?expression[x00-x20]*([^>]*+>#i','$1>',$data);
    $data=preg_replace('#(<[^>]+?)style[x00-x20]*=[x00-x20]*[`'"]*.*?behaviour[x00-x20]*([^>]*+>#i','$1>',$data);
　　$data=preg_replace('#(<[^>]+?)style[x00-x20]*=[x00-x20]*[`'"]*.*?s[x00-x20]*c[x00-x20]*r[x00-x20]*i[x00-x20]*p[x00-x20]*t[x00-x20]*:*[^>]*+>#iu','$1>',$data);
    $data=preg_replace('#]*+>#i','',$data);
    do{
        $old_data=$data;
        $data=preg_replace('#]*+>#i','',$data);
    }while($old_data!==$data);
    // we are done...
    return $data;
}