php基础知识(1)－魔术引用
php基础知识－魔术引用
示例代码下载页http://xieye.iteye.com/blog/1336095（在附件）
魔术引用是指：服务器对一些字符做自动转换，以方便程序员的做法。
来源：最开始，php的设计者为了方便程序员将表单数据添加到数据库，在配置文件中加了一个设置，当选项打开时，魔术引用启用，当选项关闭时，魔术引用不启用。
php.ini大约441行
magic_quotes_gpc = Off
注释是; Magic quotes for incoming GET/POST/Cookie data.
注释表明为on时会对进入服务器的get/post/cookie数据做自动转换。
1）addslashes函数
介绍魔术引用之前，先介绍addslashes函数
该函数返回字符串，该字符串为了数据库查询语句等的需要在某些字符前加上了反斜线。这些字符是单引号（'）、双引号（"）、反斜线（\）与 NUL（NULL 字符）。
一个使用 addslashes() 的例子是当你要往数据库中输入数据时。例如，将名字 O'reilly 插入到数据库中，这就需要对其进行转义。大多数据库使用 \ 作为转义符：O\'reilly。这样可以将数据放入数据库中，而不会插入额外的 \。当 PHP 指令 magic_quotes_sybase 被设置成 on 时，意味着插入 ' 时将使用 ' 进行转义。
默认情况下，PHP 指令 magic_quotes_gpc 为 on，它主要是对所有的 GET、POST 和 COOKIE 数据自动运行 addslashes()。不要对已经被 magic_quotes_gpc 转义过的字符串使用 addslashes()，因为这样会导致双层转义。遇到这种情况时可以使用函数 get_magic_quotes_gpc() 进行检测。
例子 1. addslashes() 示例
http://localhost/command/peixun/magicquote/1.php
<?php $str = "Is your name O'reilly?"; // 输出：Is your name O\'reilly? echo addslashes($str);
2）测试配置选项magic_quotes_gpc
首先确保magic_quotes_gpc = On,如果是off或0，则需要修改，并重启apache服务器。
http://localhost/command/peixun/magicquote/2.php
<?php
require_once('Public/CommandLine.php');
$isget = ($_SERVER['REQUEST_METHOD'] == 'GET') ? 1 : 0;
if ($isget) {
$html = <<<longs
<html>
<body>
<form method="post">
请输入字符：<input type="text" name="name1" value=''>
</form>
</body>
</html>
longs;
echo $html;
} else {
echo $_POST['name1'];
}
然后修改magic_quotes_gpc = Off,并重启apache服务器，再次测试程序。
最后要说明的是，这些都是学习概念用的，实际的大部分应用中，都将魔术引用关闭，手动的进行转换。
How does PHP identify a user's session?May 01, 2025 am 12:23 AMPHPidentifiesauser'ssessionusingsessioncookiesandsessionIDs.1)Whensession_start()iscalled,PHPgeneratesauniquesessionIDstoredinacookienamedPHPSESSIDontheuser'sbrowser.2)ThisIDallowsPHPtoretrievesessiondatafromtheserver.
What are some best practices for securing PHP sessions?May 01, 2025 am 12:22 AMThe security of PHP sessions can be achieved through the following measures: 1. Use session_regenerate_id() to regenerate the session ID when the user logs in or is an important operation. 2. Encrypt the transmission session ID through the HTTPS protocol. 3. Use session_save_path() to specify the secure directory to store session data and set permissions correctly.
Where are PHP session files stored by default?May 01, 2025 am 12:15 AMPHPsessionfilesarestoredinthedirectoryspecifiedbysession.save_path,typically/tmponUnix-likesystemsorC:\Windows\TemponWindows.Tocustomizethis:1)Usesession_save_path()tosetacustomdirectory,ensuringit'swritable;2)Verifythecustomdirectoryexistsandiswrita
How do you retrieve data from a PHP session?May 01, 2025 am 12:11 AMToretrievedatafromaPHPsession,startthesessionwithsession_start()andaccessvariablesinthe$_SESSIONarray.Forexample:1)Startthesession:session_start().2)Retrievedata:$username=$_SESSION['username'];echo"Welcome,".$username;.Sessionsareserver-si
How can you use sessions to implement a shopping cart?May 01, 2025 am 12:10 AMThe steps to build an efficient shopping cart system using sessions include: 1) Understand the definition and function of the session. The session is a server-side storage mechanism used to maintain user status across requests; 2) Implement basic session management, such as adding products to the shopping cart; 3) Expand to advanced usage, supporting product quantity management and deletion; 4) Optimize performance and security, by persisting session data and using secure session identifiers.
How do you create and use an interface in PHP?Apr 30, 2025 pm 03:40 PMThe article explains how to create, implement, and use interfaces in PHP, focusing on their benefits for code organization and maintainability.
What is the difference between crypt() and password_hash()?Apr 30, 2025 pm 03:39 PMThe article discusses the differences between crypt() and password_hash() in PHP for password hashing, focusing on their implementation, security, and suitability for modern web applications.
How can you prevent Cross-Site Scripting (XSS) in PHP?Apr 30, 2025 pm 03:38 PMArticle discusses preventing Cross-Site Scripting (XSS) in PHP through input validation, output encoding, and using tools like OWASP ESAPI and HTML Purifier.
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
SecLists
SecLists is the ultimate security tester's companion. It is a collection of various types of lists that are frequently used during security assessments, all in one place. SecLists helps make security testing more efficient and productive by conveniently providing all the lists a security tester might need. List types include usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, web shells, and more. The tester can simply pull this repository onto a new test machine and he will have access to every type of list he needs.
SublimeText3 Mac version
God-level code editing software (SublimeText3)
EditPlus Chinese cracked version
Small size, syntax highlighting, does not support code prompt function
SublimeText3 Linux new version
SublimeText3 Linux latest version
Zend Studio 13.0.1
Powerful PHP integrated development environment
