国产av日韩一区二区三区精品,成人性爱视频在线观看,国产,欧美,日韩,一区,www.成色av久久成人,2222eeee成人天堂

Home php教程 php手冊 Php 安全錯誤 Top 7

Php 安全錯誤 Top 7

Jun 21, 2016 am 09:11 AM
php print year

安全|錯誤

PHP對于飛速發(fā)展的動態(tài)網(wǎng)站來說是一門恐怖的語言。它對于新手來說也有很多友好的性質(zhì),比如變量不需要定義就可以直接使用。但是,一些類似的這種性質(zhì)使程序員不會注意到在網(wǎng)站應(yīng)用方面的一些安全問題。一個非常著名的郵件列表就充滿很多條了對PHP應(yīng)用有漏洞的例子,但一旦你理解了PHP應(yīng)用中這些基本的漏洞,PHP將變得比其他任何語言都安全。

在這篇文章中,我會詳細(xì)的說說明在一般PHP程序中常見的導(dǎo)致安全問題的錯誤。而且會展示給你什么是不能做的,還有這些特殊的漏洞是怎么被發(fā)現(xiàn)的,我希望你不但可以懂得怎么來避免這些特殊的錯誤,而且可以知道它們?yōu)槭裁磿?dǎo)致安全問題。了解每種可能出現(xiàn)的漏洞能幫助你避免在編寫PHP程序時發(fā)生同樣的錯誤。安全是一個過程,而不是一個產(chǎn)品,通過在開發(fā)應(yīng)用程序的過程中了解安全問題可以讓你編出更高效更健壯的代碼。

Unvalidated Input Errors 不受重視的輸入錯誤
最常見的PHP安全問題之一就是對用戶輸入過濾的漏洞。一般用戶提交數(shù)據(jù)都是不可信任的。你應(yīng)該假設(shè)所有所有訪問你網(wǎng)站的用戶都是惡意的。非正常輸入是很多PHP應(yīng)用程序漏洞的最根本的原因,我們將在后面進(jìn)行討論。
現(xiàn)在給大家一個例子,你可以寫下面這段代碼來允許用戶看到可以一個通過執(zhí)行UNIX中的cal命令來顯示特殊月份。

$month = $_GET[month];
$year = $_GET[year];

exec("cal $month $year", $result);
print "

"; <br>foreach ($result as $r) { print "$r<br>"; } <br>print "
";

這段代碼有很多安全問題。比如$_GET[month]和$_GET[year]沒有過濾就直接賦給了$month和$year,如果用戶輸入的月份是1到12之間,而且年份是4位數(shù)字當(dāng)然是沒有問題。不過,惡意的用戶會在年份后面加上一個";ls -la",這樣他就可以以列表的方式看到你網(wǎng)站的所有目錄。更加極端的用戶會在年份后面加上";rm -rf",這樣就能刪掉你的整個網(wǎng)站!
改正這個安全問題的最好的方法是在接收用戶輸入的數(shù)據(jù)時進(jìn)行檢測,使他成為你所希望的格式。不要使用JS來驗證,這種驗證很容易就能繞過,比如建立一個自己的表單來提交數(shù)據(jù),或者用瀏覽器禁用JS。你應(yīng)該用PHP代碼來確保輸入的年份和月份是數(shù)字,而且必須是數(shù)字。就象下面的代碼這樣:

$month = $_GET[month];
$year = $_GET[year];

if (!preg_match("/^[0-9]$/", $month)) die("Bad month, please re-enter.");
if (!preg_match("/^[0-9]$/", $year)) die("Bad year, please re-enter.");

exec("cal $month $year", $result);
print "

"; <br>foreach ($result as $r) { print "$r<br>"; } <br>print "
";

這樣的代碼就能安全的使用,而不用考慮用戶提交的數(shù)據(jù)會使你的應(yīng)用程序產(chǎn)生錯誤,或?qū)е路?wù)器運行用戶提交的非法代碼。正則表達(dá)式是驗證數(shù)據(jù)的一個非常有效的工具。雖然他很難完全掌握,但在這種情況下還是非常實用的。
你應(yīng)該驗證用戶提交的數(shù)據(jù),來拒絕所有非法的數(shù)據(jù)。一定不要在沒有驗證之前接收任何數(shù)據(jù),除非你可以確定它一定是安全的數(shù)據(jù)。這是一個常見的安全問題。但有時,惡意的用戶會通過一些方法來提交一些特定的數(shù)據(jù),這樣可以繞過你的驗證,而且會起到有害的作用。
所以你應(yīng)該嚴(yán)格的驗證提交的數(shù)據(jù),如果一些字符是不需要的,那么你應(yīng)該過濾掉這些字符或者直接拒絕接收這些的數(shù)據(jù)。

Access Control Flaws 非法控制漏洞
這是一個對PHP應(yīng)用程序來說非必要的驗證,但卻是十分重要的,就是非法控制。比如有一個管理頁,在這個頁中可以修改網(wǎng)站的配置,或會顯示一些敏感的信息。
你應(yīng)該在執(zhí)行每一個PHP應(yīng)用頁面時對用戶的權(quán)限進(jìn)行檢查。如果你只在首頁檢查了用戶的權(quán)限,那么惡意的用戶可以直接在地址欄輸入地址來進(jìn)入后面的那些沒有進(jìn)行權(quán)限判斷的頁面。
建議進(jìn)行嚴(yán)格的檢查。如果可能的話,你可以根據(jù)用戶的IP來判斷他們的權(quán)限。另一個好的方法是把把你不想讓別人訪問到的頁面放到一個特殊的目錄,并用apache中的.htaccess來保護(hù)這個目錄。
把網(wǎng)站的配置文件放在網(wǎng)站可以直接訪問的目錄之外。這種配置文件包括數(shù)據(jù)庫的密碼和其他一些會讓惡意用戶利用來攻擊你的網(wǎng)站的信息。用PHP的include函數(shù)來包含這些文件。雖然做這些事感覺有點多余,但對于網(wǎng)站的安全還是有積極的作用的。
例如我寫的PHP應(yīng)用程序。所有的自定義的函數(shù)庫都放在一個includes的文件夾中。一般把這些被包含的文件取一個以.php為后綴的文件名,這樣就算你所做的保護(hù)措施都被繞過了,服務(wù)器也會把這些文件當(dāng)做PHP文件來解析,而不會顯示這些文件的內(nèi)容。www和admin文件夾是唯一的可以通過URL直接訪問的文件夾。admin文件夾受到.htaccess的保護(hù),只允許知道儲存在.htpasswd中的用戶名和密碼的用戶可以訪問。
/home
/httpd
/www.example.com
.htpasswd
/includes
cart.class.php
config.php
/logs
access_log
error_log
/www
index.php
/admin
.htaccess
index.php
你應(yīng)該設(shè)置你的apache的默認(rèn)主頁名是index.php并且確保每個目錄都有index.php這個文件。當(dāng)別人訪問這些你不想讓別人訪問的目錄時讓他轉(zhuǎn)向到網(wǎng)站的主頁,比如存放圖片的目錄或其他類似的。
千萬不要把你的備份文件取文件名為.bak的后綴,并放在可以直接通過URL訪問的目錄。如果你這樣做了,那么在這些文件中的PHP代碼將不會被解析,甚至可能會被用戶通過URL直接下載。如果這些文件包含密碼或其他敏感的信息,那么有可能會被別人知道,甚至可能被搜索引擎,比如GOOGLE,直接搜索到而顯示在頁面上。一定要把這些文件重新命名為 .bak.php 為后綴的文件,這樣會安全一些,不過最好的解決方法還是用象CVS那樣控制。CVS學(xué)起來有一些復(fù)雜,不過你學(xué)習(xí)的所花的時間會在以后得到回報。這樣的系統(tǒng)可以讓你把每個不同版本的程序保存在不同的文件夾,如果你的程序以后出了問題,這些以前保存的版本可能會成為你無價的資源。.

[1]?[2]?[3]?下一頁??



Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undress AI Tool

Undress AI Tool

Undress images for free

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

How to get the current session ID in PHP? How to get the current session ID in PHP? Jul 13, 2025 am 03:02 AM

The method to get the current session ID in PHP is to use the session_id() function, but you must call session_start() to successfully obtain it. 1. Call session_start() to start the session; 2. Use session_id() to read the session ID and output a string similar to abc123def456ghi789; 3. If the return is empty, check whether session_start() is missing, whether the user accesses for the first time, or whether the session is destroyed; 4. The session ID can be used for logging, security verification and cross-request communication, but security needs to be paid attention to. Make sure that the session is correctly enabled and the ID can be obtained successfully.

PHP get substring from a string PHP get substring from a string Jul 13, 2025 am 02:59 AM

To extract substrings from PHP strings, you can use the substr() function, which is syntax substr(string$string,int$start,?int$length=null), and if the length is not specified, it will be intercepted to the end; when processing multi-byte characters such as Chinese, you should use the mb_substr() function to avoid garbled code; if you need to intercept the string according to a specific separator, you can use exploit() or combine strpos() and substr() to implement it, such as extracting file name extensions or domain names.

How do you perform unit testing for php code? How do you perform unit testing for php code? Jul 13, 2025 am 02:54 AM

UnittestinginPHPinvolvesverifyingindividualcodeunitslikefunctionsormethodstocatchbugsearlyandensurereliablerefactoring.1)SetupPHPUnitviaComposer,createatestdirectory,andconfigureautoloadandphpunit.xml.2)Writetestcasesfollowingthearrange-act-assertpat

How to split a string into an array in PHP How to split a string into an array in PHP Jul 13, 2025 am 02:59 AM

In PHP, the most common method is to split the string into an array using the exploit() function. This function divides the string into multiple parts through the specified delimiter and returns an array. The syntax is exploit(separator, string, limit), where separator is the separator, string is the original string, and limit is an optional parameter to control the maximum number of segments. For example $str="apple,banana,orange";$arr=explode(",",$str); The result is ["apple","bana

JavaScript Data Types: Primitive vs Reference JavaScript Data Types: Primitive vs Reference Jul 13, 2025 am 02:43 AM

JavaScript data types are divided into primitive types and reference types. Primitive types include string, number, boolean, null, undefined, and symbol. The values are immutable and copies are copied when assigning values, so they do not affect each other; reference types such as objects, arrays and functions store memory addresses, and variables pointing to the same object will affect each other. Typeof and instanceof can be used to determine types, but pay attention to the historical issues of typeofnull. Understanding these two types of differences can help write more stable and reliable code.

Using std::chrono in C Using std::chrono in C Jul 15, 2025 am 01:30 AM

std::chrono is used in C to process time, including obtaining the current time, measuring execution time, operation time point and duration, and formatting analysis time. 1. Use std::chrono::system_clock::now() to obtain the current time, which can be converted into a readable string, but the system clock may not be monotonous; 2. Use std::chrono::steady_clock to measure the execution time to ensure monotony, and convert it into milliseconds, seconds and other units through duration_cast; 3. Time point (time_point) and duration (duration) can be interoperable, but attention should be paid to unit compatibility and clock epoch (epoch)

How to pass a session variable to another page in PHP? How to pass a session variable to another page in PHP? Jul 13, 2025 am 02:39 AM

In PHP, to pass a session variable to another page, the key is to start the session correctly and use the same $_SESSION key name. 1. Before using session variables for each page, it must be called session_start() and placed in the front of the script; 2. Set session variables such as $_SESSION['username']='JohnDoe' on the first page; 3. After calling session_start() on another page, access the variables through the same key name; 4. Make sure that session_start() is called on each page, avoid outputting content in advance, and check that the session storage path on the server is writable; 5. Use ses

How does PHP handle Environment Variables? How does PHP handle Environment Variables? Jul 14, 2025 am 03:01 AM

ToaccessenvironmentvariablesinPHP,usegetenv()orthe$_ENVsuperglobal.1.getenv('VAR_NAME')retrievesaspecificvariable.2.$_ENV['VAR_NAME']accessesvariablesifvariables_orderinphp.iniincludes"E".SetvariablesviaCLIwithVAR=valuephpscript.php,inApach

See all articles