PHP cross-site attack instance analysis, PHP cross-instance analysis_PHP tutorial

php cross-site attack instance analysis, php cross-instance analysis

The examples in this article describe the principles and prevention techniques of PHP cross-site attacks. Share it with everyone for your reference. The specific method analysis is as follows:

Cross-site attacks are carried out by exploiting some details or bugs in the program. So how can we prevent cross-site attacks? Below is an example of preventing cross-site attacks. I hope it will be helpful to you.

Copy code The code is as follows:

#demo for prevent csrf
/**
* enc
*/
function encrypt($token_time) {
return md5('!@##$@$$#%43' . $token_time);
}
$token_time = time();
$token = encrypt($token_time);
$expire_time = 10;
if ($_POST) {
$_token_time = $_POST['token_time'];
$_token = $_POST['token'];
if ((time() – $_token_time) > $expire_time) {
echo “expired token”;
echo “
”;
}
echo $_token;
echo “
”;
$_token_real = encrypt($_token_time);
echo $_token_real;
//compare $_token and $_token_real
}
?>

” />
” />

By including a verification code in your form, you have virtually eliminated the risk of a cross-site request forgery attack. You can use this flow in any form that needs to perform an action
Of course, it is better to store the token in the session. Here is just a simple example

Simple analysis:

Token attack prevention is also called token. When the user accesses the page, we generate a random token to save the session and form. When the user submits, if the token we obtain is different from the session, we can submit and re-enter the submission. Data

I hope this article will be helpful to everyone’s PHP programming design.

This PHP file has been detected as a cross-site scripting vulnerability. How to fix it? ? Urgent

if($rw_uid = intval($rws[0])) { $rw_uid seems to be a cross-site scripting vulnerability caused by judgment
Example: $_GET['rewrite'] = '123_js';
Then the ideal result according to the judgment method is $_GET['uid'] = 123; $_GET['do'] = 'js';

But if $_GET['rewrite'] = 'js '; According to the judgment result, it is equal to $_GET['do'] = 'js';

This is caused by lax verification. If it is strictly required that the intrusion must be a number_string in this format, then you have to Strictly filter parameters

Use websaber to evaluate the PHP website for cross-site scripting vulnerabilities

The prevention methods are also simple:
1. Program code vulnerabilities, which require security-conscious programmers to fix. Usually, you only know which aspect to fix after the horse is hung;

2. It can also be solved through a security company. In China, security companies such as Sinesafe and NSFOCUS are more professional.

3. "Read", "Write" and "Execute" the server directory permissions. "Whether scripts are allowed", etc. Using the space of a virtual space provider that has been operating for a long time can effectively reduce the chance of being hacked.

I am engaged in the IDC industry. The above are also questions that I often encounter in my daily work. I hope my answers will be helpful to you.

http://www.bkjia.com/PHPjc/901279.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/901279.htmlTechArticlephp cross-site attack instance analysis, php cross-instance analysis This article describes the principles and prevention techniques of php cross-site attack . Share it with everyone for your reference. The specific method analysis is as follows: Cross-site attack...