PHP安全防护要点分析
关于 Web 应用程序安全性,必须认识到的第一件事是不应该信任外部数据。外部数据(outside data) 包括不是由程序员在 PHP 代码中直接输入的任何数据。在采取措施确保安全之前,来自任何其他来源(比如 GET 变量、表单 POST、数据库、配置文件、会话变量或 cookie)的任何数据都是不可信任的。
例如,下面的数据元素可以被认为是安全的,因为它们是在 PHP 中设置的。
PHP安全防护清单 1. 安全无暇的代码
<ol class="dp-xml"> <li class="alt"><span><span class="tag"><span> ?php </span></span></span></li> <li> <span>$</span><span class="attribute">myUsername</span><span> = ‘tmyer’; </span> </li> <li class="alt"> <span>$</span><span class="attribute-value">array</span><span class="attribute">arrayUsers</span><span> = array<br>(’tmyer’, ‘tom’, ‘tommy’); </span> </li> <li><span>define(”GREETING”, ‘hello<br> there’ . $myUsername); </span></li> <li class="alt"> <span class="tag">?></span><span> </span> </li> </ol>
但是,下面的数据元素都是有瑕疵的。
PHP安全防护清单 2. 不安全、有瑕疵的代码
<ol class="dp-xml"> <li class="alt"><span><span class="tag"><span> ?php </span></span></span></li> <li> <span>$</span><span class="attribute">myUsername</span><span> = $_POST[’username’]; <br>//tainted! </span> </li> <li class="alt"> <span>$</span><span class="attribute-value">array</span><span class="attribute">arrayUsers</span><span> = array($my<br>Username, ‘tom’, ‘tommy’); <br>//tainted! </span> </li> <li><span>define(”GREETING”, ‘hello there’ <br>. $myUsername); //tainted! </span></li> <li class="alt"> <span class="tag">?></span><span> </span> </li> </ol>
为 什么第一个变量 $myUsername 是有瑕疵的?因为它直接来自表单 POST。用户可以在这个输入域中输入任何字符串,包括用来清除文件或运行以前上传的文件的恶意命令。
您可能会问,“难道不能使用只接受字母 A-Z 的客户端(Javascrīpt)表单检验脚本来避免这种危险吗?”是的,这总是一个有好处的步骤,但是正如在后面会看到的,任何人都可以将任何表单下载 到自己的机器上,修改它,然后重新提交他们需要的任何内容。
解决方案很简单:必须对 $_POST[’username’] 运行清理代码。如果不这么做,那么在使用 $myUsername 的任何其他时候(比如在数组或常量中),就可能污染这些对象。
对用户输入进行清理的一个简单方法是,使用正则表达式来处理它。在这个示例中,只希望接受字母。将字符串限制为特定数量的字符,或者要求所有字母都是小写的,这可能也是个好主意。
PHP安全防护清单 3. 使用户输入变得安全
<ol class="dp-xml"> <li class="alt"><span><span class="tag"><span> ?php </span></span></span></li> <li> <span>$</span><span class="attribute">myUsername</span><span> = </span><span class="attribute-value">cleanInput</span><span>($_<br>POST[’username’]); //clean! </span> </li> <li class="alt"> <span>$</span><span class="attribute-value">array</span><span class="attribute">arrayUsers</span><span> = array(<br>$myUsername, ‘tom’, ‘tommy’); //clean! </span> </li> <li><span>define(”GREETING”, ‘hello <br>there’ . $myUsername); //clean! </span></li> <li class="alt"><span>function cleanInput($input){ </span></li> <li> <span>$</span><span class="attribute">clean</span><span> = </span><span class="attribute-value">strtolower</span><span>($input); </span> </li> <li class="alt"> <span>$</span><span class="attribute">clean</span><span> = </span><span class="attribute-value">preg_replace</span><span>(”/[^a-z]<br>/”, “”, $clean); </span> </li> <li> <span>$</span><span class="attribute">clean</span><span> = </span><span class="attribute-value">substr</span><span>($clean,0,12); </span> </li> <li class="alt"><span>return $clean; </span></li> <li><span>} </span></li> <li class="alt"> <span class="tag">?></span><span> </span> </li> </ol>
以上就是PHP安全防护的相关技巧讲解。

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

ZendStudio 13.5.1 Mac
Powerful PHP integrated development environment

mPDF
mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

MinGW - Minimalist GNU for Windows
This project is in the process of being migrated to osdn.net/projects/mingw, you can continue to follow us there. MinGW: A native Windows port of the GNU Compiler Collection (GCC), freely distributable import libraries and header files for building native Windows applications; includes extensions to the MSVC runtime to support C99 functionality. All MinGW software can run on 64-bit Windows platforms.

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Dreamweaver CS6
Visual web development tools