Detailed explanation and solutions to common security issues in PHP development (such as Sql injection, CSRF, Xss, CC, etc.)_PHP Tutorial

A brief discussion on Php security and preventing Sql injection, preventing Xss attacks, preventing hot links, and preventing CSRF

Foreword:

First of all, the author is not an expert in web security, so this is not an expert-level article on web security. It is a study note and a careful summary of the article. There are some things in it that we phpers cannot easily discover or do not pay attention to. So I wrote it down for easy reference later. There must be dedicated web security testers in large companies, and security is not the scope of PHPer's consideration. But as a PHPer, the security knowledge is: "Knowing that there is such a thing, you will naturally pay attention to it when programming."

Directory:

1. Some php security configurations
(1) Turn off the php error prompt function
(2) Turn off some "bad functions"
( 3) Strictly configure file permissions.
2. Strict data verification, not all your users are "good" people
2.1 In order to ensure the security and robustness of the program, data verification should include content.
2.2 Programmers can easily miss points or things that need attention
3. Anti-injection
3.1 Simple judgment of whether there is an injection vulnerability and the principle
3.2 Common mysql injection statements
(1) No username and password required
(2) Using a user without entering a password
(3) Guessing a user’s password
(4) Elevating privileges when inserting data
(5) Update The same applies to privilege escalation and insertion
(6) Malicious update and deletion
(7) Union, join, etc.
(8) Wildcard symbols %, _
(9) There are many guess tables Information injection sql
33 Some methods to prevent injection
2.3.1 Some functions and precautions that PHP can use to prevent injection.
2.3.2 Anti-injection character priority.
2.3.3 Anti-injection code
(1) If the parameter is a number, use the intval() function directly
(2) Filtering of non-text parameters
(3) Text data anti-injection code.
(4) Of course there are other codes combined with addslashes and mysql_escape_string.
4. Prevent xss attacks
4.1Xss attack process
4.2 Common xss attack places
4.3 Anti-XSS methods
5. CSRF
5.1 Brief explanation of CSRF principles
5.2 Prevention methods
6. Anti-hotlinking
7. Anti-CC attack

1. Some php security configurations

(1) Turn off the php error prompt function

Change display_errors in php.ini to

Copy the code The code is as follows:

display_errors = OFF

Or add

before the php file. Copy the code . The code is as follows:

error_reporting(0)

1) Use error_reporting(0); Failure example:

A file code:

Copy code The code is as follows:

error_reporting(0);
echo 555
echo 444;
?>

Error:

Copy code The code is as follows:

Parse error: parse error, expecting `','' or `';'' in E:webphp2.php on line 4

2) Use error_reporting(0); Successful example:
a File code:

Copy code The code is as follows:

error_reporting(0);
include("b.php");
?>

b file code:

Copy code The code is as follows:

echo 555
echo 444; In the first example, there is a fatal error in A.php, which prevents execution. If the server cannot be executed, it does not know that it has this function, so the same error is reported.

In the second example, a.php is executed successfully, then the server knows that there is an error suppression function, so even if b.php has an error, it is suppressed.

ps: MySQL errors cannot be suppressed.

(2) Turn off some "bad features"

1) Turn off the magic quotes function

Put magic_quotes_gpc = OFF in php.ini

Avoid repeated escaping with addslashes

2) Turn off register_globals = Off

Put register_globals = OFF in php.ini

With register_globals = ON

Address column: http://www.jb51.net?bloger=benwin

Copy code

The code is as follows:

//$bloger = $_GET['bloger'] //Because register_globals = ON, this step is not necessary and you can directly use $bloger
echo $bloger;
?>

这种情况下会导致一些未初始化的变量很容易被修改，这也许是致命的。所以把register_globals = OFF关掉

(3)严格配置文件权限。

为相应文件夹分配权限，比如包含上传图片的文件不能有执行权限，只能读取

2、严格的数据验证，你的用户不全是“好”人。

记得笔者和一个朋友在讨论数据验证的时候，他说了一句话：你不要把你用户个个都想得那么坏！但笔者想说的这个问题不该出现在我们开发情景中，我们要做的是严格验证控制数据流，哪怕10000万用户中有一个是坏用户也足以致命，再说好的用户也有时在数据input框无意输入中文的时，他已经不经意变“坏”了。

2.1为了确保程序的安全性，健壮性，数据验证应该包括

(1)     关键数据是否存在。如删除数据id是否存在
(2)     数据类型是否正确。如删除数据id是否是整数
(3)     数据长度。如字段是char(10)类型则要strlen判断数据长度
(4)     数据是否有危险字符

数据验证有些人主张是把功能完成后再慢慢去写安全验证，也有些是边开发边写验证。笔者偏向后者，这两种笔者都试过，然后发现后者写的验证相对健壮些，主要原因是刚开发时想到的安全问题比较齐全，等开发完功能再写时有两个问题，一个phper急于完成指标草草完事，二是确实漏掉某些point。
2.2程序员容易漏掉point或者说需要注意的事项：

(1)     进库数据一定要安全验证，笔者在广州某家公司参与一个公司内部系统开发的时候，见过直接把$_POST数据传给类函数classFunctionName($_POST)，理由竟然是公司内部使用的，不用那么严格。暂且不说逻辑操作与数据操控耦合高低问题，连判断都没判断的操作是致命的。安全验证必须，没任何理由推脱。
(2)     数据长度问题，如数据库建表字段char(25)，大多phper考虑到是否为空、数据类型是否正确，却忽略字符长度，忽略还好更多是懒于再去判断长度。（这个更多出现在新手当中，笔者曾经也有这样的思想）
(3)     以为前端用js判断验证过了，后台不需要判断验证。这也是致命，要知道伪造一个表单就几分钟的事，js判断只是为了减少用户提交次数从而提高用户体验、减少http请求减少服务器压力，在安全情况下不能防“小人”，当然如果合法用户在js验证控制下是完美的，但作为phper我们不能只有js验证而抛弃再一次安全验证。
(4)     缺少对表单某些属性比如select、checkbox、radio、button等的验证，这些属性在web页面上开发者已经设置定其值和值域（白名单值），这些属性值在js验证方面一般不会验证，因为合法用户只有选择权没修改权，然后phper就在后端接受数据处理验证数据的时候不会验证这些数据，这是一个惯性思维，安全问题也就有了，小人一个伪表单。
(5)     表单相应元素name和数据表的字段名一致，如用户表用户名的字段是user_name，然后表单中的用户名输入框也是user_name，这和暴库没什么区别。
(6)     过滤危险字符方面如防注入下面会独立讲解。

3、防注入

3.1简单判断是否有注入漏洞以及原理。

网址：http://www.jb51.net/benwin.php?id=1 运行正常，sql语句如：select  *  from phpben where id = 1

(1) 网址：http://www.jb51.net/benwin.php?id=1'   sql语句如：select  *  from phpben where id = 1'  然后运行异常 这能说明benwin.php文件没有对id的值进行“'” 过滤和intval()整形转换，当然想知道有没有对其他字符如“%”，“/*”等都可以用类似的方法穷举测试（很多测试软件使用）
(2)网址：http://www.jb51.net/benwin.php?id=1 and 1=1  则sql语句可能是 select  *  from phpben where id = 1 and 1=1，运行正常且结果和http://www.jb51.net/benwin.php?id=1结果一样，则说明benwin.php可能没有对空格“ ”、和“and”过滤（这里是可能，所以要看下一点）
(3)网址：http://www.jb51.net/benwin.php?id=1 and 1=2则sql语句可能是 select  *  from phpben where id = 1 and 1=2 如果运行结果异常说明sql语句中“and 1=2”起作用，所以能3个条件都满足都则很确定的benwin.php存在注入漏洞。

ps：这里用get方法验证，post也可以，只要把值按上面的输入，可以一一验证。

3.2 Common mysql injection statements.

(1) No username and password required

Copy code The code is as follows:

// Normal statement
$sql ="select * from phpben where user_name='admin' and pwd ='123'";
//Enter 'or'='or' or 'or 1=' in the user name box 1 Then the sql is as follows
$sql ="select * from phpben where user_name=' 'or'='or'' and pwd ='' ";
$sql ="select * from phpben where user_name=' ' or 1='1' and pwd ='' ";

This way there is no need to enter a password. By the way, when I see the login box, I have the urge to try it.

(2) Take advantage of a user without entering the password.

Copy code The code is as follows:

//Normal statement
$sql ="select * from phpben where user_name='$username' and pwd ='$pwd'";
//The username used is benwin, then enter benwin'# in the username box. You can have or without a password, then $sql becomes
$ sql ="select * from phpben where user_name=' benwin'#' and pwd ='$pwd'";

This is because one of the annotations in mysql is "#", and the # in the above statement is already Note out the following content, so the password can be left blank or entered arbitrarily. Some people on the Internet said that "/*" is used to annotate. What the author wants to mention is that when the annotation is only started and not ended with "*/", mysql will report an error, and it does not say "/**/" cannot be noted, but it is difficult to add "*/" To end the note, there is also "-" that can also be noted in mysql, but please note that there is at least one space after "-", which is "-". Of course, the anti-injection code must take all three into consideration. There are many things worth mentioning. In the anti-injection code, "-" is not considered in the anti-injection range.

(3) Guess a user’s password

Copy the code The code is as follows:

/ /Normal statement
$sql ="select * from phpben.com where user_name='$username' and pwd ='$pwd'";
//Enter "benwin' and left(pwd) in the password input box ,1)='p'#", then $sql is
$sql ="select * from phpben.com where user_name=' benwin' and left(pwd,1)='p'#' and pwd =' $pwd'";

If it runs normally, the first character of the password is p, and guess the remaining characters in the same way.

(4) Elevate privileges when inserting data

Copy code The code is as follows:

/ /Normal statement, level 1
$sql = "insert into phpben.com (`user_name`,`pwd`,`level`) values('benwin','iampwd',1) ";
/ /Change the statement into
$sql = "insert into phpben.com (`user_name`,`pwd`,`level`) values('benwin','iampwd',5)#', 1) ";
$sql = "insert into phpben.com (`user_name`,`pwd`,`level`) values('benwin','iampwd',5)-- ',1) "; like this Elevate a user with permission 1 to level 5

(5) Update privilege escalation and insert privilege escalation are the same

Copy code The code is as follows:

//Normal statement
$sql = "update phpben set `user_name` ='benwin', level=1";
//The final $sql obtained by entering the user name value
$sql = "update phpben set `user_name` ='benwin',level=5#', level=1";
$sql = " update phpben set `user_name` ='benwin',level=5-- ', level=1";

(6) Malicious update and deletion

Copy code The code is as follows:

//Normal statement
$sql = "update phpben set `user_name` = 'benwin' where id =1";
//After injection, the malicious code is "1 or id>0"
$sql = "update phpben set `user_name` = 'benwin' where id =1 or id>0";
//Normal statement
$sql = "update phpben set `user_name` ='benwin' where id=1";
//After injection
$sql = "update phpben set `user_name` = 'benwin' where id>0#' where id=1";
$sql = "update phpben set `user_name` ='benwin' where id>0-- ' where id=1";

(7) union, join, etc.

Copy code The code is as follows:

//Normal statement
$sql ="select * from phpben1 where `user_name`='benwin' ";
//After injection
$sql ="select * from phpben1 where `user_name`='benwin' uninon select * from phpben2#' ";
$sql ="select * from phpben1 where`user_name`='benwin' left join……#' ";

(8) Wildcard symbols %, _

Copy code The code is as follows:

// Normal statement
$sql ="select * from phpben where `user_name`='benwin' ";
//Inject wildcard symbol % to match multiple characters, and a _ matches one character, such as __ matches two characters
$sql ="select * from phpben where `user_name` like '%b' ";
$sql ="select * from phpben where `user_name` like '_b_' ";

In this way, as long as there is a user whose name starts with b, it will run normally. "_b_" matches three characters, and the middle one of these three characters is b. This is why when introducing the addslashes() function, you are prompted to note that % and _ are not escaped (actually, this is because many phpers don’t know why to filter % and _ underscores, and just blindly follow the online code)

(9) There are also a lot of guess table information injected into sql

Copy code The code is as follows:

//Normal statement
$sql ="select * from phpben1 where`user_name`='benwin'";
//Guess the table name. If it runs normally, it means there is a phpben2 table
$sql ="select * from phpben1 where`user_name`='benwin' and (select count(*) from phpben2 )>0#' ";
//Guess the table fields. If the operation is normal, it means there are phpben2 tables Field colum1
$sql ="select * from phpben1 where`user_name`='benwin' and (select count(colum1) from phpben2 )>0#'";
//Guess the field value
$ sql ="select * from phpben1 where`user_name`='benwin' and left(pwd,1)='p'#''";

Of course there are many more, and the author has not studied to the level of a professional. Here are some common ones, and they are what PHPer should know and master, instead of blindly copying and pasting some anti-injection codes online. However, I don't understand why.

The following anti-injection methods may be easier to understand in retrospect.

3.3 Some methods to prevent injection

3.3.1 Some functions and precautions that PHP can use to prevent injection.

(1)addslashes and stripslashes.

Addslashes add slashes "'", """, "\", "NULL" to these "'", """, "", "NULL". Stripslashes does the opposite. What should be noted here is php. Is magic_quotes_gpc=ON enabled in ini? Duplication will occur if addslashes is enabled. So when using it, you must first check with get_magic_quotes_gpc()

General code is similar:

Copy code The code is as follows:

if(!get_magic_quotes_gpc())
{
         $abc = addslashes($abc); , so I also wrote it down by the way. addslashes

(2)mysql_escape_string() and mysql_ real _escape_string()

mysql_real_escape_string can only be used under (PHP 4 >= 4.3.0, PHP 5). Otherwise, you can only use mysql_escape_string

to copy the code

. The code is as follows:if (PHP_VERSION >= '4.3')

{

$string = mysql_real_escape_string($string);
}else
{
$string = mysql_escape_string($string);
}

mysql_escape_string() and mysql_ real The difference with _escape_string() is that the latter will determine the current database connection character set. In other words, a similar error will occur without connecting to the database:

Copy code

The code is as follows:Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'ODBC'@'localhost' (using password: NO) in E: webphptest.php on line 11

(3) Character replacement function and matching function
str_replace() and perg_replace() are also mentioned here because these functions can be used to filter or replace some Sensitive, deadly character.

3.3.2 Anti-injection character priority.

To prevent injection, you must first know what injection characters or keywords there are. Common mysql injection characters include character delimiters such as "'" and """; logical keywords such as "and" and "or"; mysql notes Characters such as "#", "–", "/**/"; mysql wildcard characters "%", "_"; mysql keyword "select|insert|update|delete|*|union|join|into|load_file|outfile ”

(1) For some parameters with prescribed formats, the highest priority for anti-injection is "space".

For example, some parameters such as bank card numbers, ID numbers, email addresses, phone numbers, birthdays, postal codes, etc. have their own formats and the format stipulates that there cannot be spaces. When filtering, spaces are generally filtered out first ( Including some space "variants"), because other characters define symbols, logical keywords, and mysql notes. Note that the following figure shows that the important ones are "'", " "

ps: Variants of space characters are: "%20", "n", "r", "rn", "nr", "chr("32″)" This is why mysql_escape_string() and mysql_real_escape_string() Two functions escape "n", "r". In fact, many PHPers only know how to escape n and r without knowing the reason. When MySQL parses n and r, they treat them as spaces. The author has tested and verified it, so I will not post the code here.

(2) “and”, “or”, “”, “#”, “–”

Logical key can combine many injected codes; mysql annotation annotates all the characters behind the inherent sql code so that the injected sql statement can run normally; "" can also combine many injected characters x00, x1a.

ps: SQL parsing "#" and "-" are not considered by most mysql anti-injection codes, and are also ignored by many phpers. Also, some PHPers use "-" to separate parameters when assigning values, so the author recommends not to write parameters in this way. Of course, you can also use "-" when filtering parameters (note that there are spaces. If there are no spaces, it will not be parsed as a note. Note) When filtering as a whole instead of filtering "-", this avoids excessive filtering parameters.

(3) "null", "%", "_"

These cannot be independent and should not be used under specific circumstances. For example, the wildcard characters "%, _" must be included in the mysql like clause. Therefore, the filtering of "%" and "_" is generally filtered only when the search is related. They cannot be included in the normal filtering queue, because some such as mailboxes can have the "_" character

(4) Keyword "select|insert|update|delete|*|union|join|into|load_file|outfile"

Maybe you will ask why these important keywords have such low priority. What the author wants to say is that these keywords are not harmful when purchased without "'", """, " ", "and", "or", etc. In other words, these keywords are not "independent" and "dependent" enough. "Exceptionally large. Of course, the low priority does not mean that it should not be filtered.

3.3.3 Anti-injection code.

(1) If the parameter is a number, use the intval() function directly

Note: Many popular anti-injection codes on the Internet are just filtered by addslashes(), mysql_escape_string(), mysql_real_escape_string() or any combination of the three. However, phper thinks it is filtered, and there are still loopholes if you are not careful, that is When the parameter is a number:

Copy code The code is as follows:

$id = addslashes($_POST['id']); //The correct one is $id = intval($_POST['id']);
$sql =" select * from phpben.com where id =$id";
$sql =" select * from phpben. com where id =1 or 1=1";

It is easy to find that after the post data is filtered by addslashes, many injections have no effect, but $id does not have an intval, which leads to the existence of the vulnerability. It's a small detail, but it can lead to loopholes if you're not careful.

(2) Filtering of non-text parameters

Text parameters refer to titles, messages, content, etc. that may contain "'", "'", etc. It is impossible to escape or replace them all during filtering.

But non-text data is OK.

Copy code The code is as follows:

function _str_replace($str ) 
{ 
     $str = str_replace(" ","",$str); 
     $str = str_replace("n","",$str); 
     $str = str_replace("r","",$str); 
     $str = str_replace("'","",$str); 
     $str = str_replace('"',"",$str); 
     $str = str_replace("or","",$str); 
     $str = str_replace("and","",$str); 
     $str = str_replace("#","",$str); 
     $str = str_replace("\","",$str); 
     $str = str_replace("-- ","",$str); 
     $str = str_replace("null","",$str); 
     $str = str_replace("%","",$str); 
     //$str = str_replace("_","",$str); 
     $str = str_replace(">","",$str); 
     $str = str_replace("<","",$str); 
     $str = str_replace("=","",$str); 
     $str = str_replace("char","",$str); 
     $str = str_replace("declare","",$str); 
     $str = str_replace("select","",$str); 
     $str = str_replace("create","",$str); 
     $str = str_replace("delete","",$str); 
     $str = str_replace("insert","",$str); 
     $str = str_replace("execute","",$str); 
     $str = str_replace("update","",$str); 
     $str = str_replace("count","",$str); 
     return $str; 
}

ps：还有一些从列表页操作过来的一般href是”phpben.php?action=delete&id=1”,这时候就注意啦，_str_replace($_GET['action'])会把参数过滤掉，笔者一般不用敏感关键作为参数，比如delete会写成del，update写成edite，只要不影响可读性即可;

还有上面代码过滤下划线的笔者注悉掉了，因为有些参数可以使用下划线，自己权衡怎么过滤;

有些代码把关键字当重点过滤对象，其实关键字的str_replace很容易“蒙过关”，str_replace(“ininsertsert”)过滤后的字符还是insert，所以关键的是其他字符而不是mysql关键字。

(3)文本数据防注入代码。

文本参数是指标题、留言、内容等这些数据不可能也用str_replace()过滤掉，这样就导致数据的完整性，这是很不可取的。

代码：

复制代码 代码如下:

function no_inject($str) 

{ 
         if(is_array($str)) 
         { 
                   foreach($str as $key =>$val) 
                   { 
                           $str[$key]=no_inject($val); 
                   } 
         }else 
         { 
                   $str = str_replace(" "," ",$str); 
                   $str = str_replace("\","",$str); 
                   $str = str_replace("'","'",$str); 
                   $str = str_replace('"',""",$str); 
                   $str = str_replace("or","or",$str); 
                   $str = str_replace("and","and",$str); 
                   $str = str_replace("#","#",$str); 
                   $str = str_replace("-- ","-- ",$str); 
                   $str = str_replace("null","null",$str); 
                   $str = str_replace("%","%",$str); 
                   //$str = str_replace("_","",$str); 
                   $str = str_replace(">",">",$str); 
                   $str = str_replace("<","<",$str); 
                   $str = str_replace("=","=",$str); 
                   $str = str_replace("char","char",$str);   
                   $str = str_replace("declare","declare",$str); 
                   $str = str_replace("select","select",$str); 
                  $str = str_replace("create","create",$str); 
                  $str = str_replace("delete","delete",$str); 
                  $str = str_replace("insert","insert",$str); 
                 $str = str_replace("execute","execute",$str); 
                 $str = str_replace("update","update",$str); 
                 $str = str_replace("count","count",$str); 
         } 
    return $str; 
}

(4) Of course there are other codes combined with addslashes and mysql_escape_string.

The anti-injection codes actually come and go in those combinations, and then they are adapted according to their own program codes. The author has not considered all of these codes. It is better that cookes, sessions, and requests are not fully filtered. The important thing is to know the principle, why these characters are filtered, and what harm the characters have.

4. Prevent xss attacks

XSS: cross site script, why is it not called css, so as not to be confused with div+css.

4.1Xss attack process:

(1) Found that station A has an xss vulnerability.

(2) Inject xss vulnerability code. It can be js code, Trojan horse, script file, etc. Here, if the benwin.php file of station A has a vulnerability.

(3) Use some methods to deceive relevant personnel of station A to run benwin.php, and use some member information of relevant personnel such as cookies, permissions, etc.

Related personnel:

Administrators (such as Tieba moderators) generally have certain permissions. The purpose is to borrow the administrator's authority or perform privilege escalation, add or add administrators, add backdoors, upload Trojans, or further penetrate and other related operations.

Members of Station A: Members run benwin.php of Station A. The purpose is generally to steal members’ information on site A.

Method:

1) Post information on site A to lure relevant people to benwin.php, such as a website address. This is local deception

2) Send deceptive information or emails on other websites.

Usually using disguised URLs to trick relevant personnel of station A into clicking into benwin.php

(4) The third step is usually an xss attack. If you want to attack further, repeat steps (2) and (3) to achieve the goal.

A simple example of xss attack

Code: benwin.php file

Copy code The code is as follows:

< head>

When the value of username $user_name is "benwin" onSubmit= "alert('This is an example of an xss attack');" class= ""(here)

Copy code The code is as follows:

A prompt box will pop up when the form is submitted.

(1) It is obvious that $user_name did not filter xss characters when saving it into the database (similar to anti-injection, here is an example) ==> Vulnerability found

(2) Construct xss code: benwin” onSubmit="alert('This is an example of xss attack');" class="" Pass in the database

(3) Deceive relevant personnel to come in and click the "Submit" button

4.2 Common xss attack places

(1)Js place

Copy code The code is as follows:

< ;script language="javascript">
var testname =" ";

The value of $testname only needs to comply with js Closed relationship: ""; alert("test xss ");" (the same applies below)

(2)In the form

Copy the code The code is as follows:

(3)a tag

Copy code The code is as follows:

a tag can hide xss attacks

(4) The frequently used img tag

Copy code The code is as follows:

Even the entire img tag is inserted into some text and hidden using width, height, css, etc.

(5)Address bar

In short, any place where data is output, or more accurately, where user-submitted data is output, may be a place for XSS attacks.

4.3 Anti-XSS methods

The anti-XSS method is actually very similar to the anti-injection method. They are all methods of filtering, substitution, materialization, etc.

(1) Filter or remove special Html tags.

For example: < , >, <,, > ',",