How does a PHP Web site prevent SQL injection?

The operation of the site is sure that every webmaster must consider the issue, you know, most hackers attack the site is the use of SQL injection, this is what we often say why? The most original static website is the safest. Today we talk about PHP injection security specifications to prevent your site from being injected into SQL. Now that the mainstream web development language is PHP, let's start with how the PHP Web site prevents SQL injection: PHP injection security Through the above process, we can understand the principles and methods of PHP injection, of course, we can also work out the corresponding prevention method: The first is the security settings for the server, which is primarily Php+mysql security settings and Linux Host Security settings. For Php+mysql injection prevention, first set MAGIC_QUOTES_GPC to On,display_errs set to OFF, if ID type, we use Intval () to convert it to an integer type, such as code: $idintval ($id); Mysql_query "*fromexamplewherearticieid ' $id '"; or write this: mysql_query ("Select*fromarticlewherearticleid". Intval ($id). "") If it is a character type, filter it with addslashes () and then filter "%" and "_" such as: $searchaddslashes ($search); $searchstr _replace ("_", "\_", $search); $searchstr _replace ("%", "\%", $search); Of course, you can also add PHP Universal anti-injection code: /************************* PHP Universal Anti-inject security code Description Determine if the passed variable contains illegal characters such as $_post, $_get Function: Anti-injection **************************/ Illegal characters to filter on $ArrFiltratearray ("'", ";", "union"); The URL to jump after the error, without filling the default previous page $StrGoUrl ""; Whether the values in the array exist Functionfunstringexist ($StrFiltrate, $ArrFiltrate) { Feach ($ArrFiltrateas $key> $value) { if (eregi ($value, $StrFiltrate)) { Returntrue; } } Returnfalse; } Merging $_post and $_get if (function_exists (Array_merge)) { $ArrPostAndGetarray _merge ($HTTP _post_vars, $HTTP _get_vars); }else{ Feach ($HTTP _post_varsas$key> $value) { $ArrPostAndGet [] $value; } Feach ($HTTP _get_varsas$key> $value) { $ArrPostAndGet [] $value; } } Validation begins Feach ($ArrPostAndGetas $key> $value) { if (Funstringexist ($value, $ArrFiltrate)) { echo "Alert (/" NEEAO hint, illegal character/");"; if (empty ($STRGOURL)) { echo "Histy.go (-1);"; }else{ echo "window.location/" ". $StrGoUrl." /”;”; } Exit } } ?> /************************* Copy CodeSave As Checkpostget.php Then add an include ("checkpostget.php") to each PHP file; **************************/ In addition, the Administrator user name and password are taken MD5 encryption, so as to effectively prevent the injection of PHP. There are also servers and MySQL to strengthen some security precautions. Security settings for Linux servers: Encrypt the password and use the/usr/sbin/authconfig tool to turn on the shadow function of the passcode and encrypt the passwd. Disable access to important files, enter the Linux command interface, and enter at the prompt: #chmod600/etc/inetd.conf//Change the file property to 600 #chattr +i/etc/inetd.conf//Guarantee file owner is root #chattr –i/etc/inetd.conf//restrictions on changes to this file Prevents any user from changing to the root user through the SU command Add the following two lines at the beginning of the SU configuration file, which is the/etc/pam.d/directory: Auth Sufficient/lib/security/pam_rootok.sodebug Auth Required/lib/security/pam_whell.sogroupwheel Delete all special accounts #userdel LP and so on delete user #groupdellp等等删除组 Prohibit Suid/sgid programs that are not used #find/-typef\ (-perm-04000-o–perm-02000\) \-execls–lg{}\; Http://hi.baidu.com/bigideaer/bl ... 7e76e11a4cffd0.html Determine if the passed variable contains illegal characters we put the following code in a common file, For example, in the security.inc.php, each file contains the file, then you can give any one of the program to submit all the variables to filter, to achieve our effect once and for all. Description:/************************* Description Determine if the passed variable contains illegal characters such as $_post, $_get Function: Anti-injection **************************/ The code is as follows: Illegal characters to filter on $ArrFiltratearray ("", ";", "union"); The URL to jump after the error, without filling the default previous page $StrGoUrl ""; Whether the values in the array exist Functionfunstringexist ($StrFiltrate, $ArrFiltrate) { Feach ($ArrFiltrateas $key> $value) { if (eregi ($value, $StrFiltrate)) { Returntrue; } } Returnfalse; } Merging $_post and $_get if (function_exists (Array_merge)) { $ArrPostAndGetarray _merge ($HTTP _post_vars, $HTTP _get_vars); }else{ Feach ($HTTP _post_varsas$key> $value) { $ArrPostAndGet [] $value; } Feach ($HTTP _get_varsas$key> $value) { $ArrPostAndGet [] $value; } } Validation begins Feach ($ArrPostAndGetas $key> $value) { if (Funstringexist ($value, $ArrFiltrate)) { echo ""; if (Emptyempty ($STRGOURL)) { echo ""; }else{ echo ""; } Exit } } ?> Copy CodeSave As Checkpostget.php Then add an include ("checkpostget.php") to each PHP file; Method 2 The code is as follows: /* Filter all get over variables */ Feach ($_getas$get_key> $get _var) { if (Is_numeric ($get _var)) { $get [Strtolower ($get _key)]get_int ($get _var); }else{ $get [Strtolower ($get _key)]get_str ($get _var); } } /* Filter all post-over variables */ Feach ($_postas$post_key> $post _var) { if (Is_numeric ($post _var)) { $post [Strtolower ($post _key)]get_int ($post _var); }else{ $post [Strtolower ($post _key)]get_str ($post _var); } } /* Filter Function */ Integer Filter function Functionget_int ($number) { Returnintval ($number); } string-Type Filter function Functionget_str ($string) { if (!GET_MAGIC_QUOTES_GPC ()) { Returnaddslashes ($string); } return$string; } Copy CodeThe first is the way to escape the data The second method, written in a separate file, is introduced into each PHP file. Can be implemented to escape each data processing Functionsaddslashes ($string) { if (Is_array ($string)) { Feach ($stringas $key> $val) { $string [$key]saddslashes ($val); } }else{ $stringaddslashes ($string); } return$string; } ################################################################# $magic _QUOTEGET_MAGIC_QUOTES_GPC (); if (Empty ($magic _quote)) { $_getsaddslashes ($_get); $_postsaddslashes ($_post); }

This topic was released by Beckham on 2015-9-20 13:05

