The role of verification code is mainly to prevent violent cracking, prevent malicious irrigation, prevent automatic submission, etc., here I will not say more. The type of verification code also has numbers, letters and so on, even the more powerful point of the Chinese. But no matter how powerful your verification code is, as long as you have the following errors in the form verification, your verification code is a fake!
The general idea of the verification code is to visit a script file every time you log in, the file generates a picture with a verification code and writes the value to the session, and when submitted, verifies that the login script will determine whether the verification code submitted is consistent with the session.
The problem arises, after the login password error, we do not go to the file to generate the verification image, then if the session in the verification code is not emptied, the verification code is the same as the last time, the hard-built verification code mechanism is the same as a dummy.
Let's look at a problematic code first:
Landing section:
CODE:
Administrator Name: Td>
Td>
Tr>
Administrator Password: Td>
Td>
Tr>
Verification Code: Td>
Td>
Tr>
Td>
Tr>
?> There's nothing wrong here, look at the code for the login verification (I think this is the way of verifying that most people are using it):
code:/*------------------------------------------------------*/
--Verify login information
/*------------------------------------------------------ */
if ($_request[' act '] = = ' signin ')
{
Include ('.. /includes/cls_captcha.php ');
/* Check that the verification code is correct */
$validator = new Captcha ();
if (! $validator->check_word ($_post[' captcha '))
{
Sys_msg ($_lang[' Captcha_error '), 1);
}
/* Check that the password is correct */
$sql = "Select user_id, user_name, password, action_list from". $ecs->table (' Admin_user ').
"WHERE user_name= ' $_post[username] ' and password= '". MD5 ($_post[' password ']). "'";
$row = $db->getrow ($sql);
if ($row)
{
Login successful
Set_admin_session ($row [' user_id '], $row [' user_name '], $row [' action_list '];
Update last logon time and IP
$db->execute ("UPDATE". $ecs->table (' Admin_user ').
"SET last_time=". Date (' y-m-d h:i:s ', Time ()). "', last_ip= '". REAL_IP (). "'".
"WHERE user_id=$_session[admin_id]") or Die ($db->errormsg ());
if (Isset ($_post[' remember '))
{
Setcookie (' ecscp[admin_id] ', $row [0], time () + 3600 * 24 * 360);
Setcookie (' ecscp[admin_pass] ', MD5 ($row [' Password ']. $_cfg[' Hash_code ']), time () + 3600 * 24 * 360);
}
Header (' location:./');
}
Else
{
Sys_msg ($_lang[' Login_faild '), 1);
}
}
?> the problem is in the above code, after checking the password error, and did not update the verification code, so that we can take the landing page verification code picture part, and as long as the URL to access the Verification code page, you can only submit the user name, password, just get the verification code to achieve the brute force, Using this method, the same can be achieved irrigation, brush tickets and so on.
You can see the following pictures, enhance the point of intuitive understanding.
=700) window.open (' http://www.bkjia.com/uploads/allimg/131016/05251961K-0.gif '); "src=" http://www.bkjia.com/ Uploads/allimg/131016/05251961k-0.gif "onload=" if (this.width> ') this.width= ' "," if (this.height> ' 700 ') this.height= ' border=0> ';
Workaround: We need to check the password error after updating the verification code, for the type of message, but also to update the verification code after the successful submission.
Security is the case, we always want to make our own procedures more secure, but in general, we always walk in the conventional thinking can not jump out, so that our program has a lot of "non-conventional loopholes", or called "defects", in short, is imperfect. I write this article in addition to point out the above problem, but also hope that everyone can act, with "unconventional" vision, re-examine their own procedures, more than before they did not find the small problems posted out, so that everyone together to improve!
http://www.bkjia.com/PHPjc/317687.html www.bkjia.com true http://www.bkjia.com/PHPjc/317687.html techarticle the role of verification code is mainly to prevent violent cracking, prevent malicious irrigation, prevent automatic submission, etc., here I will not say more. The type of verification code also has numbers, letters and so on, even more ...
