How does a php website prevent SQL injection? [Top]

How does a php website prevent SQL injection? [Top]

Website operation security must be considered by every Webmaster. as you know, most websites attacked by hackers use SQL injection, which is what we often say? The most primitive static website is the safest. Today we will talk about PHP injection security specifications to prevent your website from being injected with SQL statements. Today's mainstream website development language is php. let's start with how php websites prevent SQL injection: Through the above process, we can understand the principles and techniques of Php injection. of course, we can also work out the appropriate defense methods: The first step is to set the server security. here, we mainly set the security of php + mysql and the security of linux hosts. To prevent injection of php + mysql, set magic_quotes_gpc to On and display_errs to Off. if the id type is set, we use intval () to convert it to an integer type, such as code: $ Idintval ($ id ); Mysql_query "* fromexamplewherearticieid '$ ID'"; or write: mysql_query ("SELECT * FROMarticleWHEREarticleid". intval ($ id )."") If it is a replica type, use addslashes () to filter it, and then filter "%" and "_", such: $ Searchaddslashes ($ search ); $ Searchstr_replace ("_", "\ _", $ search ); $ Searchstr_replace ("%", "\ %", $ search ); Of course, you can also add php universal anti-injection code: /************************* PHP general anti-injection security code Note: Determines whether the passed variable contains invalid characters. Such as $ _ POST and $ _ GET Function: Anti-injection **************************/ // Invalid characters to be filtered $ ArrFiltratearray ("'", ";", "union "); // The url to be redirected after an error occurs. If this parameter is left blank, the previous page is displayed by default. $ StrGoUrl ""; // Whether the value in the array exists FunctionFunStringExist ($ StrFiltrate, $ ArrFiltrate ){ Feach ($ ArrFiltrateas $ key> $ value ){ If (eregi ($ value, $ StrFiltrate )){ Returntrue; } } Returnfalse; } // Merge $ _ POST and $ _ GET If (function_exists (array_merge )){ $ ArrPostAndGetarray_merge ($ HTTP_POST_VARS, $ HTTP_GET_VARS ); } Else { Feach ($ HTTP_POST_VARSas $ key> $ value ){ $ ArrPostAndGet [] $ value; } Feach ($ HTTP_GET_VARSas $ key> $ value ){ $ ArrPostAndGet [] $ value; } } // Verification starts Feach ($ ArrPostAndGetas $ key> $ value ){ If (FunStringExist ($ value, $ ArrFiltrate )){ Echo "alert (/" Neeao prompt, illegal character /");"; If (empty ($ StrGoUrl )){ Echo "histy. go (-1 );"; } Else { Echo "window. location/" ". $ StrGoUrl ."/";"; } Exit; } } ?> /************************* Save as checkpostget. php Add include ("checkpostget. php") before each php file. **************************/ In addition, the administrator username and password are encrypted using md5, which effectively prevents php injection. There are also servers and mysql to enhance security. For linux server security settings: Use the "/usr/sbin/authconfig" tool to enable the password shadow function and encrypt passwd. Prohibit access to important files. go to the linux command interface and enter: # Chmod600/etc/inetd. conf // change the file attribute to 600 # Chattr + I/etc/inetd. conf // ensure that the file owner is root # Chattr-I/etc/inetd. conf // restrict changes to this file Prohibit any user from changing to a root user through the su command Add the following two lines at the beginning of the su configuration file/etc/pam. d: Auth sufficient/lib/security/pam_rootok.sodebug Auth required/lib/security/pam_whell.sogroupwheel Delete all special accounts # Deleting users such as userdel lp # Groupdellp and so on Disable unused suid/sgid programs # Find/-typef \ (-perm-04000-o-perm-02000 \) \-execls-lg {}\; You can get the original php video tutorial CD for free. for details, contact the customer service on the official website: Http://www.lampbrother.net