Php security problems

Php Security issues are developed on the web. I believe that building has some basic security knowledge and "never trust client data". Php is a weak language. Many people ignore type conversion during development, and parameter filtering directly results in immeasurable consequences. If the filter function is not used, the database may be injected with SQL. It can directly cause your system to crash and system data loss. php security problems

For web development, I believe that building has some basic security knowledge and "never trust client data". Php is a weak language. Many people ignore type conversion during development, and parameter filtering directly results in immeasurable consequences.

If the filter function is not used, the following situations may occur:

The database is injected with SQL statements. This can directly cause your system to crash, cause loss of system data, and cause loss of user information. If your website is infected with Trojans, you can delete your website files if you encounter file processing.

In addition, it is worth mentioning that many people think that it is all right to enable the php Security mode. In fact, many injecting users tend to bypass the front and conduct side attacks.

Use? 0 × 7e, 0 × 27, and other (ASCII code) strings are used as quotation marks, which cannot be filtered by php. The general method of injection is to add a lot of mysql in the parameter? SQL syntax to obtain sensitive data information.

Exp:

And (select1from (select? Count (*), concat (select? Concat (0x7e, 0x27, phpcms_member.username, 0x27, 0x7e) from? Phpcms_member? Limit0, 1) from? Information_schema.tableslimit0, 1), floor (rand (0) * 2) x? From? Information_schema.tablesgroupby? X) a) and1 = 1

All mysql information_schema.tables users can view and query the table structure and database information.

Php has many open-source systems. many open-source systems know the data structure and sensitive information table. (Of course, criminals are also included here)

Sensitive information: usually user information and management information. Currently, md5 exhaustion is ongoing. Many md5-encrypted passwords can still be decrypted into plain text.

Many systems have made corresponding security improvements.

The following describes the common methods:

Using the filter function, the php filter security filter function. md5 (? Md5 ('User password'). 'private key') to obtain the encryption result. You must modify the directory name in the background of a common php open-source system. Admin is directly used as the background Portal for many systems. Do not place phpmyadmin and other database operation software in the visible directory of the website.

And so on .. This is because a large number of scanning tools exist to scan such management terminals.

The following is a shocking figure.

?

Mysql injection

?

Mysql injection

Source:? Martin blog [http://www.blags.org/]

Link:? Http://www.blags.org/php-security-issue/

?