Php project code security summary _ PHP Tutorial

Php project code security summary. During many times of modular development in php development projects, there may be a lot of security hidden. The following is a summary of the security of some php project code I have summarized, there is a need for many times of modular development when using php development projects. at this time, there may be a lot of security hidden. The following is a summary of the security of some php project code I have summarized, for more information, see.

1: Basic,
Include $ module. '. php '; $ module if you GET it directly using GET, it is a very devastating bug. in linux, it makes you feel bad, and in windows, it makes you ready to work, this type of security is generally directly discovered and effectively prevented. if you haven't even done this, can you be a qualified programmer?

2: quality and security.
Many people will say that the external variables should be addslashes once. no matter whether the addslashes function is efficient and secure, many people forget to pay attention to security before using addslashes. index. php? Aa [] = 222 &, this is the url, addslashes ($ aa); the system will report an error. it can be seen that while using functions, we should know the different data types, what will happen. as mentioned in previous articles, the function has registered a parameter> 0 numeric type. what should I do if a user passes in a letter. many people think it is a function error. in my opinion, it is a user error. although it is a user-defined function, it is not safe to pass parameters without your intention.

3: stress security.
At present, you occasionally read 163 of the news, and you will find that the browser suddenly crashes, and even the browser is "closed ". this may be caused by webpage program code problems or front-end js problems, especially js. due to the flexible js features, it is not easy to find errors in loop and assignment, the most prominent point is the value and error re-processing. for example, getelementbyid ('myp'); have you ever wondered whether myp exists? Is it modified twice? Another point is that when images cannot be loaded, many people use onerror to display the default image again. Have you ever thought about it? Is it an infinite loop?

4: PHP performance security.
No one can say that there has never been an infinite loop that causes apache to crash. even better people have the same experience. what pressure does the loop generate? What performance is affected? See the following code:
Foreach ($ array AS $ val ){
$ Payarr = include ('pay. inc. php ');
If ($ payarr [0]> = 360*1.25 + 568 ){
$ Err [] = $ payarr [0];
}
}
This code can run normally. no matter whether the include is successful or not, you do not need to judge whether it is meaningful or not. it can run successfully. of course, it is meaningless. to truly implement the functional requirements, this code requires several additional lines, all of which are judgment. should I check whether the file exists by is_file before introducing the file? Should I use include_once in a loop? The condition value is a numeric operation. Is it better to write a direct value? Before determining, should we first determine whether the $ payarr array value exists?

5: write or judge when writing a program.
The above performance security talk about the lack of a lot of judgment, whether php has a document display, meaningless judgment whether it affects performance. see the code.
If (is_resource ($ a) ==== false | is_array ($ a) ===false | is_bool ($ a) ==== false)
Echo $;
What if we make this decision every time we use a variable? Is it safer? The code is correct. echo only prints the string type, and the previous judgment is logical. this may be more like strict security, but it may not be a good thing if php can omit this performance pressure. at least the requirements are met, and security is also increased. of course, we will also be thinking, in this case, are I writing a program or writing a judgment?

6: blocking error.
When many people were learning php, the teacher said a word about security, which made him remember and blocked the error message. in my opinion, blocking errors should be conditional. that is, the display is blocked, but the record cannot be blocked. one day, a Web page was blank and asked the programmer to check the error. He told me that the error was blocked. do you think this is reasonable? I want you to block errors, but I don't want you to block yourself. even you don't know where the errors are. can common users? Therefore, when using php. ini blocking or @, remember to know where the error occurred.

7: interface security.
I believe that all of you have interfaces for security. no matter what you have, I do. the common practice is to request the url, and then print the value to the client in php, so that the client can perform judgment and processing, or display and processing. in fact, in this way, common php staff can easily get the url through firebug to know what the parameters you get and what the returned values are, which is potentially dangerous, for example, product comments and product prices. for this reason, we recommend that you use a token for the interface and then upload the parameter. the work done by tokey is very meaningful. it can calculate whether the user is normal, ip address, and request time. you can determine when you request an interface next. the token value is encrypted and cannot be used or retained by the user. you may ask, the token is a string of characters, and it can keep the request interface. let me drop my mind. please use the request time.

8: Display security.
In fact, I have not fully understood the problem of display security. for example, I need to record the user's signature and support html code. after submission, what about addslashes or htmlspecialchars before the data is stored in mysql? If it is addslashes, the front-end display may be injected by xss. if htmlspecialchars is used, how can I display the html code in front-end display? What can xss be prevented at the same time? If there are so many variables in a website, do you think about this one by one? How to prevent attacks?

9: egg is safe.
Whether you believe it or not, I believe that sohpex will hurt, and the zend encrypted code does not seem to be available after php5.3. your security is too unreliable. it turned out to be PR security. it was handed over to programmers for implementation. this is not the case for business models.

The security summary of Ghost Project code is necessary...