Security Tips-How to write a secure PHP code _php tutorial

As the owner of the site or practitioners do not want their own site can be safe to operate, but many times when the site development of a small negligence, it is likely to become a huge site security risks. There are many tools and languages for web development today, and PHP is one of them. The PHP language itself has unparalleled security features, but it does not attract the attention of web developers. Website security can ensure the security of sensitive data of enterprise employees, and even effectively prevent the hijacking of servers and other issues. The following author will use PHP to develop some of the suggestions and discussions, hope can bring users some help.

First of all, the most important thing is to understand the various variables and user input data. Many of the variables that you don't notice themselves are likely to be a great way to spread infection by malware programs. We can assume that there are some code that is not too secure on your site, but it works fine. Attackers who exploit these vulnerabilities can engage in vandalism on your site. Do not underestimate these obscure variable names, which, once exploited by hackers, are not just deleting files and deleting the entire cipher system or other sensitive information, which can eventually cause great damage to the server's normal operation.

The site administrator must check the contents of any externally entered files for malicious code , and database security is also critical. Database security will involve a lot of SQL injection and other attack methods, here do not elaborate, if users want to understand database security information, I will be detailed according to requirements.

　　Magic Quotes

The Magic quotes is very useful when working with user file input. When this option is turned on (in your php.ini file) it will separate all the single and double quotation marks, or the null bytes from the user's input information. One of the questions when you turn on magic quote is whether you want your users to filter by quotation marks. If you turn off Magic Quote, you can parse a string of user input data in "runtime".

If you are not familiar with PHP, I suggest you start this function until you have learned how to analyze and represent the data entered by the user. I personally recommend using the "purge" feature I wrote. I will provide you with a template so that you can write a clear function on your own.

function Clean ($string) { $string = Stripslashes ($string); $string = Htmlentities ($string); $string = Strip_tags ($string); return $string; } ?>

If your users are submitting a form that requires user name verification, you can use the following features:

$username = $_post[username]; echo Clean ($mystring); ?>

For this magic quote, there are 3 kinds of instructions to implement. You can refer to php.net website or PHP manual. These three kinds of instructions are basically MAGIC_QUOTES_GPC, which are used to process access requests (get,post,cookies). Magic_quotes_runtime is used to process files and databases, external files. The third is magic_quotes_sybase, if it is activated, it will be the direct abolition of MAGIC_QUOTES_GPC.

　　The security gained through obscurity

You may not have noticed recently, but I found that in some Web sites the PHP language can be found in the ASP (Active Server Page Dynamic server home) or Perl (a GGI scripting language) extension language, we can 100% sure this site is using the php/ SQL-based architecture. This is a typical confusing security strategy, rather than telling hackers that you are using PHP scripts to mislead them into thinking that you are running Perl or Python or any other scripting language.

For example, you can use PHP extensions to run PHP scripts just as you would normally. In order to keep people from seeing your "hello.php" script, you are actually using Apache to hide or confuse real file extensions. So instead of using the "hello.php" extension, you can disguise these files as Perl, and your "hello.php" is still a PHP script. Just like the following:

[Quote] AddType application/x-httpd-php. asp. py. Pl[/quote]

My favorite thing is to make up a file extension, such as. sun or. Fuck

[Quote] AddType application/x-httpd-php. Sun fuck. 1e3t[/quote]

I'm sure that when a hacker encounters a PHP file that looks like it's running. Sun file will be eager to launch attacks, the consequences can be imagined. Try it and you'll find out. The above code is used for the Apache configuration file and you will not be able to access the Apache configuration file if you are on a shared host.

　　Register Globals

PHP changed a lot when the Global4.2 version appeared. This is an open or closed selection for the INI file in the php.ini file, and PHP is not forcing you to use the same primitive parameters as other languages, which is why people regard it as an unsafe language. When register globals is turned on, it will allow the request to set parameters. The best example is the user registration form. We assume that register globals is turned on:

if ($authed = True) { echo "My sensitive information"; } ?>

Any user can access sensitive information by sending a GET request. You can display sensitive information by Telnet (either a standard protocol for the remote join service or the software that implements the protocol) or a browser, such as Sin.php?authed=true. If we close it, it will stop the problem, and now when we visit the Sin.php?authed=true page, it will be blank. The user cannot initialize a variable from an external source. Another way to protect your variables from the effects of external sources is to check whether they are through get or post requests.

$authed = true; if (Isset ($_post[authed]) | | $_get[authed]) { echo "Variable violation"; } else { if ($authed = = True) { echo "My sensitive information"; } } ?>

By monitoring the Get or POST request, we can check to see if someone is injecting something into our variables. The next message we received included not only that they had broken the variables, but also that they were able to notify the administrator to make the emergency action.

http://www.bkjia.com/PHPjc/364205.html www.bkjia.com true http://www.bkjia.com/PHPjc/364205.html techarticle as the owner of the site or practitioners do not want their own site can be safe operation, but many times when the site development of a small negligence, it is likely to become a huge security potential site ...

