PHP prevents use of cross-site scripting HTTP link attacks

2015-7-18 22:02:21

What needs to be stressed in the PHP form?

$_server["Php_self"] variables are likely to be used by hackers!

When hackers use HTTP links to cross-site scripts to attack, $_server["php_self"] Server variables are also inserted into the script. The reason is that cross-site scripting is appended to the path of the execution file, so the string $_server["Php_self" will contain the JavaScript code behind the HTTP link.

	XSS is also called CSS (Cross-site script), cross-site scripting attacks. A malicious attacker inserts malicious HTML code into a Web page, and when the user browses to the page, HTML code embedded inside the Web is executed to achieve the special purpose of the malicious user.

Specifies that the following form file is named "test_form.php":

<form method= "POST" action= "<?php echo $_server[" php_self "];? > ">

Now, we use the URL to specify the commit address "http://www.w3cschool.cc/test_form.php", and the above code is modified to resemble the following:

<form method= "POST" action= "test_form.php" >

It's good to do that.

However, given that the user will enter the following address in the browser address bar:

Http://www.w3cschool.cc/test_form.php/%22%3E%3Cscript%3Ealert (' hacked ')%3c/script%3e

In this case, the above code is translated to:

<form method= "POST" action= "test_form.php"/><script>alert (' hacked ') </script>

The script tag is added to the code and the alert command is added. The JavaScript code executes when the page is loaded (the user will see a popup box). This is just a simple example of how php_self variables can be exploited by hackers.

Please note that any JavaScript code can be added to the <script> tab! Hackers can use this redirect page to another Server page, the page code file can protect malicious code, the code can modify global variables or get the user's form data, instance:

How to avoid $_server["php_self") being exploited?

$_server["Php_self"] can be avoided by using the Htmlspecialchars () function.

The form code looks like this:

<form method= "POST" action= "<?php Echo htmlspecialchars ($_server[" php_self "]);? > ">

Htmlspecialchars () converts some of the predefined characters to HTML entities. Now if the user wants to take advantage of the php_self variable, the result will be output as follows:

<form method= "POST" action= "Test_form.php/&quot;&gt;&lt;script&gt;alert (' hacked ') &lt;/ Script&gt; " >

Failed to attempt the vulnerability!

PHP prevents use of cross-site scripting HTTP link attacks