整理一些PHP开发安全问题
php给了开发者极大的灵活性，但是这也为安全问题带来了潜在的隐患，近期需要总结一下以往的问题，在这里借翻译一篇文章同时加上自己开发的一些感触总结一下。
简介
当开发一个互联网服务的时候，必须时刻牢记安全观念，并在开发的代码中体现。PHP脚本语言对安全问题并不关心，特别是对大多数没有经验的开发者来说。每当你讲任何涉及到钱财事务等交易问题时，需要特别注意安全问题的考虑，例如开发一个论坛或者是一个购物车等。
安全保护一般性要点
不相信表单
对于一般的Javascript前台验证，由于无法得知用户的行为，例如关闭了浏览器的javascript引擎，这样通过POST恶意数据到服务器。需要在服务器端进行验证，对每个php脚本验证传递到的数据，防止XSS攻击和SQL注入
不相信用户
要假设你的网站接收的每一条数据都是存在恶意代码的，存在隐藏的威胁，要对每一条数据都进行清理
关闭全局变量
在php.ini文件中进行以下配置：
register_globals = Off
如果这个配置选项打开之后，会出现很大的安全隐患。例如有一个process.php的脚本文件，会将接收到的数据插入到数据库，接收用户输入数据的表单可能如下：
<input name="username" type="text" size="15" maxlength="64">
这样，当提交数据到process.php之后，php会注册一个$username变量，将这个变量数据提交到process.php，同时对于任何POST或GET请求参数，都会设置这样的变量。如果不是显示进行初始化那么就会出现下面的问题（参考：http://www.lai18.com/content/434606.html）
<?php// Define $authorized = true only if user is authenticatedif (authenticated_user()) { $authorized = true;}?>
此处，假设authenticated_user函数就是判断$authorized变量的值，如果开启了register_globals配置，那么任何用户都可以发送一个请求，来设置$authorized变量的值为任意值从而就能绕过这个验证。
所有的这些提交数据都应该通过PHP预定义内置的全局数组来获取，包括$_POST、$_GET、$_FILES、$_SERVER、$_REQUEST等，其中$_REQUEST是一个$_GET/$_POST/$_COOKIE三个数组的联合变量，默认的顺序是$_COOKIE、$_POST、$_GET。
推荐的安全配置选项
error_reporting设置为Off：不要暴露错误信息给用户，开发的时候可以设置为ON
safe_mode设置为Off
register_globals设置为Off
将以下函数禁用：system、exec、passthru、shell_exec、proc_open、popen
open_basedir设置为 /tmp ，这样可以让session信息有存储权限，同时设置单独的网站根目录
expose_php设置为Off
allow_url_fopen设置为Off
allow_url_include设置为Off
SQL注入攻击
对于操作数据库的SQL语句，需要特别注意安全性，因为用户可能输入特定语句使得原有的SQL语句改变了功能。类似下面的例子：
扩展阅读
《PHP安全编程系列》系列技术文章整理收藏
PHP安全编程系列收藏夹收藏了有关PHP安全编程方面的知识，对PHP安全编程提供学习参考
1discuz的php防止sql注入函数
2php防止xss攻击的方法
3PHP安全编程：对输出要进行转义
4PHP安全编程：过滤用户输入
5PHP安全编程：可用性与数据跟踪
6PHP安全编程：不要让不相关的人看到报错信息
7PHP安全编程：register_globals的安全性
8PHP安全编程：网站安全设计的一些原则
9PHP安全编程：关于表单欺骗提交
10PHP安全编程：HTTP请求欺骗
11PHP安全编程：不要暴露数据库访问权限
12PHP安全编程：跨站请求伪造CSRF的防御
13PHP安全编程：表单与数据安全
14PHP安全编程：从URL的语义进行攻击
15PHP安全编程：文件上传攻击的防御
16PHP安全编程：跨站脚本攻击的防御
17PHP安全编程：session固定获取合法会话
18PHP安全编程：防止SQL注入
19PHP安全编程：cookie暴露导致session被劫持
20PHP安全编程：防止源代码的暴露
21PHP安全编程：留心后门URL
22PHP安全编程：session劫持的防御
23PHP安全编程：暴力破解攻击
24PHP安全编程：密码嗅探与重播攻击
25PHP安全编程：记住登录状态的安全做法
26PHP安全编程：shell命令注入
27PHP安全编程：打开远程文件的风险
28PHP安全编程：文件目录猜测漏洞
29PHP安全编程：阻止文件名被操纵
30PHP安全编程：文件包含的代码注入攻击
31PHP安全编程：更优的会话数据安全
32PHP安全编程：共享主机的源码安全
33PHP安全编程：会话数据注入
34PHP安全编程：主机文件目录浏览
35PHP安全编程：PHP的安全模式
36php安全之直接用$获取值而不$_GET 字符转义
37php防止漏洞策略，创建高性能web
38什么XSS攻击？PHP防止XSS攻击函数
39解析php防止form重复提交的方法
40php安全之狗尾续貂
41PHP防止跨域提交表单
42php防止SQL注入详解及防范
43php防止sql注入代码实例
44php防止sql注入示例分析和几种常见攻击正则表达式
45PHP安全之防止你的源代码或重要配置信息暴露在外
46PHP防止post重复提交数据的简单例子
47php防止伪造的数据从URL提交方法
48PHP防止表单重复提交的几种常用方法汇总
49php防止伪造数据从地址栏URL提交的方法
50php防止站外远程提交表单的方法
51php防止sql注入之过滤分页参数实例
52PHP安全之以Apache模式安装时可能遇到的攻击及解决办法
53PHP安全之文件系统安全及防范措施
54PHP安全之文件系统安全??Null字符问题
55PHP安全之数据库安全??SQL注入及预防措施
56PHP安全之简介和总则
57PHP安全之以CGI 模式安装时可能遇到的攻击及解决办法
58PHP安全之用户提交的数据
59PHP安全之数据库安全??设计、连接和加密
60PHP安全之魔术引号??什么是魔术引号以及如何使用
61PHP安全之隐藏PHP脚本扩展名
62PHP安全之使用 Register Globals
63PHP安全之错误报告
64php防止恶意刷新与刷票的方法
65php防止网站被刷新的方法汇总
66PHP网站常见安全漏洞，及相应防范措施总结
The Continued Use of PHP: Reasons for Its EnduranceApr 19, 2025 am 12:23 AMWhat’s still popular is the ease of use, flexibility and a strong ecosystem. 1) Ease of use and simple syntax make it the first choice for beginners. 2) Closely integrated with web development, excellent interaction with HTTP requests and database. 3) The huge ecosystem provides a wealth of tools and libraries. 4) Active community and open source nature adapts them to new needs and technology trends.
PHP and Python: Exploring Their Similarities and DifferencesApr 19, 2025 am 12:21 AMPHP and Python are both high-level programming languages that are widely used in web development, data processing and automation tasks. 1.PHP is often used to build dynamic websites and content management systems, while Python is often used to build web frameworks and data science. 2.PHP uses echo to output content, Python uses print. 3. Both support object-oriented programming, but the syntax and keywords are different. 4. PHP supports weak type conversion, while Python is more stringent. 5. PHP performance optimization includes using OPcache and asynchronous programming, while Python uses cProfile and asynchronous programming.
PHP and Python: Different Paradigms ExplainedApr 18, 2025 am 12:26 AMPHP is mainly procedural programming, but also supports object-oriented programming (OOP); Python supports a variety of paradigms, including OOP, functional and procedural programming. PHP is suitable for web development, and Python is suitable for a variety of applications such as data analysis and machine learning.
PHP and Python: A Deep Dive into Their HistoryApr 18, 2025 am 12:25 AMPHP originated in 1994 and was developed by RasmusLerdorf. It was originally used to track website visitors and gradually evolved into a server-side scripting language and was widely used in web development. Python was developed by Guidovan Rossum in the late 1980s and was first released in 1991. It emphasizes code readability and simplicity, and is suitable for scientific computing, data analysis and other fields.
Choosing Between PHP and Python: A GuideApr 18, 2025 am 12:24 AMPHP is suitable for web development and rapid prototyping, and Python is suitable for data science and machine learning. 1.PHP is used for dynamic web development, with simple syntax and suitable for rapid development. 2. Python has concise syntax, is suitable for multiple fields, and has a strong library ecosystem.
PHP and Frameworks: Modernizing the LanguageApr 18, 2025 am 12:14 AMPHP remains important in the modernization process because it supports a large number of websites and applications and adapts to development needs through frameworks. 1.PHP7 improves performance and introduces new features. 2. Modern frameworks such as Laravel, Symfony and CodeIgniter simplify development and improve code quality. 3. Performance optimization and best practices further improve application efficiency.
PHP's Impact: Web Development and BeyondApr 18, 2025 am 12:10 AMPHPhassignificantlyimpactedwebdevelopmentandextendsbeyondit.1)ItpowersmajorplatformslikeWordPressandexcelsindatabaseinteractions.2)PHP'sadaptabilityallowsittoscaleforlargeapplicationsusingframeworkslikeLaravel.3)Beyondweb,PHPisusedincommand-linescrip
How does PHP type hinting work, including scalar types, return types, union types, and nullable types?Apr 17, 2025 am 12:25 AMPHP type prompts to improve code quality and readability. 1) Scalar type tips: Since PHP7.0, basic data types are allowed to be specified in function parameters, such as int, float, etc. 2) Return type prompt: Ensure the consistency of the function return value type. 3) Union type prompt: Since PHP8.0, multiple types are allowed to be specified in function parameters or return values. 4) Nullable type prompt: Allows to include null values and handle functions that may return null values.
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Atom editor mac version download
The most popular open source editor
SublimeText3 Linux new version
SublimeText3 Linux latest version
mPDF
mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),
Zend Studio 13.0.1
Powerful PHP integrated development environment
SecLists
SecLists is the ultimate security tester's companion. It is a collection of various types of lists that are frequently used during security assessments, all in one place. SecLists helps make security testing more efficient and productive by conveniently providing all the lists a security tester might need. List types include usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, web shells, and more. The tester can simply pull this repository onto a new test machine and he will have access to every type of list he needs.
