PHP backend design: exploration of security and permission control

With the popularity of the Internet and Web applications, PHP has become one of the most popular backend languages. However, the development of PHP backend involves very important security and permission control issues.

In this article, we will explore security and permission control in PHP backend design, and provide specific code examples to help readers better understand these issues.

1. Security Issues

When it comes to PHP security issues, it mainly involves the following aspects:

1. SQL injection attack

SQL injection is an attack method that exploits vulnerabilities in web applications to manipulate or view data by manipulating the input of SQL queries. To avoid SQL injection attacks, we need to protect ourselves while writing code.

The following is a simple SQL injection example:

$username = $_POST['username'];

$sql = "SELECT * FROM user WHERE username='$username'";

In this example, the attacker can bypass the user by entering ' or 1=1 -- Enter the content and obtain the data of the entire user table. To prevent this from happening, we need to use prepared statements in PHP.

The modified sample code is as follows:

$username = $_POST['username'];

$stmt = $pdo->prepare("SELECT * FROM user WHERE username=?");
$stmt->execute([$username]);

$user = $stmt->fetch();

In this example, we use the preprocessing statement in PDO to separate the user input content from the SQL statement. This can effectively avoid SQL injection attacks.

2. XSS attack

XSS attack is a technique that exploits vulnerabilities in web applications and allows an attacker to inject HTML tags or JavaScript code into the user's browser. In order to avoid XSS attacks, we need to use the htmlspecialchars() function to filter user input.

The following is a simple XSS attack example:

echo "Welcome, " . $_GET['username'] . "!";

The attacker can pass a JavaScript code as the username parameter, for example: http://localhost/welcome.php?username =<script>alert("XSS!")</script>, so that an alert box can pop up in the user's browser.

In order to avoid this situation, we need to use the htmlspecialchars() function to filter the content entered by the user. The modified code is as follows:

echo "Welcome, " . htmlspecialchars($_GET['username'], ENT_QUOTES, 'UTF-8') . "!";

In this example, we use the htmlspecialchars() function to filter user input, so that XSS attacks can be avoided.

3. CSRF attack

A CSRF attack is a type of vulnerability that exploits web applications. An attacker can construct a page or URL that allows users to execute without their knowledge. certain operations. To avoid CSRF attacks, we need to use CSRF tokens or the same origin policy.

The following is a simple CSRF attack example:

<!-- 在攻击者的网站上 -->
<img  src="/static/imghwm/default1.png"  data-src="http://localhost/delete.php?id=1?x-oss-process=image/resize,p_40"  class="lazy" alt="PHP backend design: exploration of security and permission control" >

The attacker allows the user to access this page by sending an email to the user or publishing a blog post. This page will delete the record with id 1 without the user's knowledge.

To avoid this happening, we need to use CSRF tokens or same-origin policy. The sample code is as follows:

<!-- 在表单中添加CSRF令牌 -->
<form action="delete.php" method="POST">
  <input type="hidden" name="token" value="<?php echo md5(session_id()); ?>">
  <input type="hidden" name="id" value="1">
  <button type="submit" class="btn btn-danger">删除</button>
</form>

In this example, we use a CSRF token to prevent malicious attackers from constructing pages or URLs to attack our system.

2. Permission control issues

When it comes to PHP permission control issues, it mainly involves the following aspects:

1. Authentication

In order to ensure the security of the system, the user's identity must be authenticated. Authentication is required before handling sensitive operations.

The sample code is as follows:

if (! check_user_permission('admin')) {
  die("Permission denied!");
}

// 进行敏感操作

In this example, we use the check_user_permission() function to check whether the user has permission to operate. If the user does not have permission, the operation is terminated.

2. Role Control

Different users in the system may need different permissions and operation scopes. In order to achieve this kind of permission control, role control method is usually used.

The sample code is as follows:

// 用户与角色映射关系
$users = [
  'Alice' => ['admin'],
  'Bob' => ['editor'],
  'Charlie' => ['editor', 'viewer'],
];

// 检查当前用户的角色
function get_user_roles($username) {
  global $users;
  return $users[$username] ?? [];
}

// 检查用户是否有权限
function check_user_permission($username, $permission) {
  $roles = get_user_roles($username);
  foreach ($roles as $role) {
    if (isset($permissions[$role]) && $permissions[$role][$permission]) {
      return true;
    }    
  }
  return false;
}

// 定义角色与权限映射关系
$permissions = [
  'admin' => ['create', 'update', 'delete'],
  'editor' => ['create', 'update'],
  'viewer' => ['view'],
];

// 检查用户是否有权限
if (!check_user_permission('Alice', 'delete')) {
  die("Permission denied!");
}

// 进行敏感操作

In this example, we define the mapping relationship between roles and permissions, and use the check_user_permission() function to check whether the user has permission to operate. If the user does not have permission, the operation is terminated.

The above is some discussion of security and permission control issues in PHP backend design. We recommend that developers enhance their learning and understanding of these issues during the actual development process, and adhere to the best practices for security and permission control when writing code.

If you have any questions or need further assistance, please feel free to contact us.

The above is the detailed content of PHP backend design: exploration of security and permission control. For more information, please follow other related articles on the PHP Chinese website!