How does a php website prevent SQL injection? -Php Tutorial

How does a php website prevent SQL injection?

Website operation security must be considered by every Webmaster. as you know, most websites attacked by hackers use SQL injection, which is what we often say? The most primitive static website is the safest. Today we will talk about PHP injection security specifications to prevent your website from being injected with SQL statements. Today's mainstream website development language is php. let's start with how php websites prevent SQL injection: Through the above process, we can understand the principles and techniques of Php injection. of course, we can also work out the appropriate defense methods: The first step is to set the server security. here, we mainly set the security of php + mysql and the security of linux hosts. To prevent injection of php + mysql, set magic_quotes_gpc to On and display_errs to Off. if the id type is set, we use intval () to convert it to an integer type, such as code: $ Idintval ($ id ); Mysql_query "* fromexamplewherearticieid '$ ID'"; or write: mysql_query ("SELECT * FROMarticleWHEREarticleid". intval ($ id )."") If it is a replica type, use addslashes () to filter it, and then filter "%" and "_", such: $ Searchaddslashes ($ search ); $ Searchstr_replace ("_", "\ _", $ search ); $ Searchstr_replace ("%", "\ %", $ search ); Of course, you can also add php universal anti-injection code: /************************* PHP general anti-injection security code Note: Determines whether the passed variable contains invalid characters. Such as $ _ POST and $ _ GET Function: Anti-injection **************************/ // Invalid characters to be filtered $ ArrFiltratearray ("'", ";", "union "); // The url to be redirected after an error occurs. If this parameter is left blank, the previous page is displayed by default. $ StrGoUrl ""; // Whether the value in the array exists FunctionFunStringExist ($ StrFiltrate, $ ArrFiltrate ){ Feach ($ ArrFiltrateas $ key> $ value ){ If (eregi ($ value, $ StrFiltrate )){ Returntrue; } } Returnfalse; } // Merge $ _ POST and $ _ GET If (function_exists (array_merge )){ $ ArrPostAndGetarray_merge ($ HTTP_POST_VARS, $ HTTP_GET_VARS ); } Else { Feach ($ HTTP_POST_VARSas $ key> $ value ){ $ ArrPostAndGet [] $ value; } Feach ($ HTTP_GET_VARSas $ key> $ value ){ $ ArrPostAndGet [] $ value; } } // Verification starts Feach ($ ArrPostAndGetas $ key> $ value ){ If (FunStringExist ($ value, $ ArrFiltrate )){ Echo "alert (/" Neeao prompt, illegal character /");"; If (empty ($ StrGoUrl )){ Echo "histy. go (-1 );"; } Else { Echo "window. location/" ". $ StrGoUrl ."/";"; } Exit; } } ?> /************************* Save as checkpostget. php Add include ("checkpostget. php") before each php file. **************************/ In addition, the administrator username and password are encrypted using md5, which effectively prevents php injection. There are also servers and mysql to enhance security. For linux server security settings: Use the "/usr/sbin/authconfig" tool to enable the password shadow function and encrypt passwd. Prohibit access to important files. go to the linux command interface and enter: # Chmod600/etc/inetd. conf // change the file attribute to 600 # Chattr + I/etc/inetd. conf // ensure that the file owner is root # Chattr-I/etc/inetd. conf // restrict changes to this file Prohibit any user from changing to a root user through the su command Add the following two lines at the beginning of the su configuration file/etc/pam. d: Auth sufficient/lib/security/pam_rootok.sodebug Auth required/lib/security/pam_whell.sogroupwheel Delete all special accounts # Deleting users such as userdel lp # Groupdellp and so on Disable unused suid/sgid programs # Find/-typef \ (-perm-04000-o-perm-02000 \) \-execls-lg {}\; Http://hi.baidu.com/bigideaer/bl... 7e76e11a4cffd0.html To determine whether the passed variable contains illegal characters, we put the following code into a public file, such as security. inc. in php, every file contains this file, so that all variables submitted by any program can be filtered out, which achieves our effect once and for all. Brief description :/************************* Note: Determines whether the passed variable contains invalid characters. Such as $ _ POST and $ _ GET Function: Anti-injection **************************/ The code is as follows: // Invalid characters to be filtered $ ArrFiltratearray ("", ";", "union "); // The url to be redirected after an error occurs. If this parameter is left blank, the previous page is displayed by default. $ StrGoUrl ""; // Whether the value in the array exists FunctionFunStringExist ($ StrFiltrate, $ ArrFiltrate ){ Feach ($ ArrFiltrateas $ key> $ value ){ If (eregi ($ value, $ StrFiltrate )){ Returntrue; } } Returnfalse; } // Merge $ _ POST and $ _ GET If (function_exists (array_merge )){ $ ArrPostAndGetarray_merge ($ HTTP_POST_VARS, $ HTTP_GET_VARS ); } Else { Feach ($ HTTP_POST_VARSas $ key> $ value ){ $ ArrPostAndGet [] $ value; } Feach ($ HTTP_GET_VARSas $ key> $ value ){ $ ArrPostAndGet [] $ value; } } // Verification starts Feach ($ ArrPostAndGetas $ key> $ value ){ If (FunStringExist ($ value, $ ArrFiltrate )){ Echo" Alert (\ "invalid character \"); script "; If (emptyempty ($ StrGoUrl )){ Echo" Histy. go (-1); script "; } Else { Echo" Window. location \ "". $ StrGoUrl. "\"; script "; } Exit; } } ?> Save as checkpostget. php Add include ("checkpostget. php") before each php file. Method 2 The code is as follows: /* Filter all GET variables */ Feach ($ _ GETas $ get_key> $ get_var) { If (is_numeric ($ get_var )){ $ Get [strtolower ($ get_key)] get_int ($ get_var ); } Else { $ Get [strtolower ($ get_key)] get_str ($ get_var ); } } /* Filter all POST variables */ Feach ($ _ POSTas $ post_key> $ post_var) { If (is_numeric ($ post_var )){ $ Post [strtolower ($ post_key)] get_int ($ post_var ); } Else { $ Post [strtolower ($ post_key)] get_str ($ post_var ); } } /* Filter function */ // Integer filter function Functionget_int ($ number) { Returnintval ($ number ); } // String filter function Functionget_str ($ string) { If (! Get_magic_quotes_gpc ()){ Returnaddslashes ($ string ); } Return $ string; } The first method is to escape data. The second method is written in a separate file, and each php file is introduced. You can escape each data. Functionsaddslashes ($ string ){ If (is_array ($ string )){ Feach ($ stringas $ key> $ val ){ $ String [$ key] saddslashes ($ val ); } } Else { $ Stringaddslashes ($ string ); } Return $ string; } ######################################## ######################### $ Magic_quoteget_magic_quotes_gpc (); If (empty ($ magic_quote )){ $ _ GETsaddslashes ($ _ GET ); $ _ POSTsaddslashes ($ _ POST ); }

This topic was removed from the top of the topic by Beckham at, September 20 ,.