Jonathan Goh ♪ 🐈
says to
YSITD
就算没经过php处理，<img src="./file/blah.jpg">也不会有xss吧