PHP security technology to achieve basic php Security. 1. do not rely on the registry of global variables function (register_globals) to register global variables. this once made PHP very easy to use, but also reduced security (convenience often compromises security ).
1. do not rely on the registration of global variables function (register_globals)
Registration of global variables once made PHP very easy to use, but also reduced security (convenience often compromises security ). We recommend that you disable the register_globals command during programming and disable this function in PHP6.
2. initialize the variable before using it.
If the register_globals function is enabled, even if the programmer does not use it, malicious users may exploit the variable initialization vulnerability to intrude into our system. For example:
If (conditon ){
$ Auth = TRUE;
}
If the variable $ auth is not initialized to FALSE before this period, then, you can pass $ _ GET ['auth'], $ _ POST ['auth '], or $ _ COOKIE ['auth'] to the script for easy verification.
3. check and purify all input data.
4. be careful when using variables to reference include files.
If the script contains the following code:
Require ($ page );
Make sure that $ page does not come from external resources (such as $ _ GET), or, if it does come from external resources, make sure it contains the appropriate value.
5. be careful when using functions that execute commands on any server.
These functions include eval (), exec (), system (), passthru (), popen (), and anti-apostrophes (''). These functions can execute commands on the server and never use them at will. If you have to include the variable in the command, you should perform a thorough security check on the variable. You should also use escapeshellarg () escapeshellcom () for additional preprocessing.
6. change the default session directory or use the database to save session data.
7. do not use the file name provided by the browser to save the uploaded file on the server.
8. if the submitted data needs to be re-displayed on the web page, pay attention to the HTML, and more importantly, JAVASCRIPT.
Functions available
String htmlspecialchars (string [, int quote_style [, string charset])
Process submitted data
9. Do not expose your PHP error information on the site
PHP error messages can be output during your development to facilitate your inspection. However, if they are exposed to the Web, they can become the entry point for attackers.
10. prevent SQL injection attacks.
Use Database escape functions in a specific language, such as mysqli_real_escape_data () to ensure that the submitted content does not disrupt the query operation.
11. never save the phpinfo () script on the server.
The appearance of register (register_globals) to register global variables has made PHP very easy to use, but it also reduces the security (convenience will often undermine security...
