Home  >  Article  >  Backend Development  >  Detailed explanation of steps to prevent cross-site and xss attacks in PHP

Detailed explanation of steps to prevent cross-site and xss attacks in PHP

php中世界最好的语言
php中世界最好的语言Original
2018-05-19 14:01:431450browse

这次给大家带来PHP实现防止跨站与xss攻击步骤详解,PHP实现防止跨站与xss攻击的注意事项有哪些,下面就是实战案例,一起来看一下。

文档说明

1.将waf.php传到要包含的文件的目录

2.在页面中加入防护,有两种做法,根据情况二选一即可:

a).在所需要防护的页面加入代码

require_once('waf.php');

就可以做到页面防注入、跨站

如果想整站防注,就在网站的一个公用文件中,如数据库链接文件config.inc.php中!

添加require_once('waf.php');来调用本代码

常用php系统添加文件

PHPCMS V9 \phpcms\base.php
PHPWIND8.7 \data\sql_config.php
DEDECMS5.7 \data\common.inc.php
DiscuzX2   \config\config_global.php
Wordpress   \wp-config.php
Metinfo   \include\head.php

b).在每个文件最前加上代码

在php.ini中找到:

Automatically add files before or after any PHP document.

auto_prepend_file = waf.php路径;

PHP文件 waf.php

<?php
/*云体检通用漏洞防护补丁v1.1
更新时间:2013-05-25
功能说明:防护XSS,SQL,代码执行,文件包含等多种高危漏洞
*/
$url_arr=array(
&#39;xss&#39;=>"\\=\\+\\/v(?:8|9|\\+|\\/)|\\%0acontent\\-(?:id|location|type|transfer\\-encoding)",
);
$args_arr=array(
'xss'=>"[\\'\\\"\\;\\*\\<\\>].*\\bon[a-zA-Z]{3,15}[\\s\\r\\n\\v\\f]*\\=|\\b(?:expression)\\(|\\<script[\\s\\\\\\/]|\\<\\!\\[cdata\\[|\\b(?:eval|alert|prompt|msgbox)\\s*\\(|url\\((?:\\#|data|javascript)",
&#39;sql&#39;=>"[^\\{\\s]{1}(\\s|\\b)+(?:select\\b|update\\b|insert(?:(\\/\\*.*?\\*\\/)|(\\s)|(\\+))+into\\b).+?(?:from\\b|set\\b)|[^\\{\\s]{1}(\\s|\\b)+(?:create|delete|drop|truncate|rename|desc)(?:(\\/\\*.*?\\*\\/)|(\\s)|(\\+))+(?:table\\b|from\\b|database\\b)|into(?:(\\/\\*.*?\\*\\/)|\\s|\\+)+(?:dump|out)file\\b|\\bsleep\\([\\s]*[\\d]+[\\s]*\\)|benchmark\\(([^\\,]*)\\,([^\\,]*)\\)|(?:declare|set|select)\\b.*@|union\\b.*(?:select|all)\\b|(?:select|update|insert|create|delete|drop|grant|truncate|rename|exec|desc|from|table|database|set|where)\\b.*(charset|ascii|bin|char|uncompress|concat|concat_ws|conv|export_set|hex|instr|left|load_file|locate|mid|sub|substring|oct|reverse|right|unhex)\\(|(?:master\\.\\.sysdatabases|msysaccessobjects|msysqueries|sysmodules|mysql\\.db|sys\\.database_name|information_schema\\.|sysobjects|sp_makewebtask|xp_cmdshell|sp_oamethod|sp_addextendedproc|sp_oacreate|xp_regread|sys\\.dbms_export_extension)",
'other'=>"\\.\\.[\\\\\\/].*\\%00([^0-9a-fA-F]|$)|%00[\\'\\\"\\.]");
$referer=empty($_SERVER['HTTP_REFERER']) ? array() : array($_SERVER['HTTP_REFERER']);
$query_string=empty($_SERVER["QUERY_STRING"]) ? array() : array($_SERVER["QUERY_STRING"]);
check_data($query_string,$url_arr);
check_data($_GET,$args_arr);
check_data($_POST,$args_arr);
check_data($_COOKIE,$args_arr);
check_data($referer,$args_arr);
function W_log($log)
{
  $logpath=$_SERVER["DOCUMENT_ROOT"]."/log.txt";
  $log_f=fopen($logpath,"a+");
  fputs($log_f,$log."\r\n");
  fclose($log_f);
}
function check_data($arr,$v) {
 foreach($arr as $key=>$value)
 {
  if(!is_array($key))
  { check($key,$v);}
  else
  { check_data($key,$v);}
  if(!is_array($value))
  { check($value,$v);}
  else
  { check_data($value,$v);}
 }
}
function check($str,$v)
{
  foreach($v as $key=>$value)
  {
  if (preg_match("/".$value."/is",$str)==1||preg_match("/".$value."/is",urlencode($str))==1)
    {
      //W_log("<br>IP: ".$_SERVER["REMOTE_ADDR"]."<br>时间: ".strftime("%Y-%m-%d %H:%M:%S")."<br>页面:".$_SERVER["PHP_SELF"]."<br>提交方式: ".$_SERVER["REQUEST_METHOD"]."<br>提交数据: ".$str);
      print "您的提交带有不合法参数,谢谢合作";
      exit();
    }
  }
}
?>

相信看了本文案例你已经掌握了方法,更多精彩请关注php中文网其它相关文章!

推荐阅读:

PHP运用foreach转换数组步骤详解

php 删除一维数组中值元素步骤详解

The above is the detailed content of Detailed explanation of steps to prevent cross-site and xss attacks in PHP. For more information, please follow other related articles on the PHP Chinese website!

Statement:
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn