the existence of a foreword problem
from the code level, that is, the application level to consider the security of the code (that is, regardless of the underlying language itself, such as the vulnerability), the scripting security problem is the problem of functions and variables. The variable directly or indirectly receives the user's unsafe input, because of the nature of PHP itself, it is easier to find the confusion in PHP (many PHP programs are used to define and initialize and receive variables, you can directly in the program using $id such variables, initialization completely by the PHP settings to complete, If you are not careful, you may cause the variable to be confusing and thus cause an attack.
variables receive unsafe input, do not do proper filtering and use in different places, can cause different harm. If you go directly to the database and then display it to the user, it can result in Cross-site scripting attacks, which, if used in SQL statements, can lead to SQL injection attacks that are unrelated to a specific scripting language and may exist in a variety of scripting languages. Because PHP's variables are flexible, these harmful variables, if used in some logical statements, can cause critical code to skip such as authentication failures and skip initialization of some variables, resulting in confusion in the program logic and other vulnerabilities. If this variable is used in dangerous functions such as include, and so on, of course, there will be a file-containing vulnerability, which in the fopen function may produce a write-file vulnerability, which appears in the Mysql_query function as SQL injection vulnerability, eval, and Preg_ Replace can cause code execution, and the environment that appears in the Htmlspecia function that may be causing an error and the absolute path disclosure variable appears to determine its possible harm.
thinking about the existence of the problem, how do you check for this vulnerability at the code level? Of course, familiar with the PHP language is the most basic, it should also be to catch the function and the variable, if there is a variable in the dangerous function, then determine the source of the variable, whether it is properly initialized, whether the user can inject sensitive characters after initialization, whether the sensitive characters are thoroughly cleared before entering the function. The difficulty with code audits may lie in determining the source of the variable, this requires familiarity with the PHP features and the code you audit, but not all of the variables are visible from the source, and perhaps some of the initialized code doesn't work as expected, and something in the variables may also come from places you don't want him to be. There are also variables that may come from a database or system configuration file, but it is likely that the database and configuration files have been modified before, or that these variables are not securely manipulated later, and these variables are not trusted. Here we think about the security of the scripting code in terms of variables and functions.
where do two variables come from?
1 shows the input
called the variable from where it actually means the threat comes from, just consider from the web, what is the safest site? It is clear that sites that provide only static HTML pages are the safest, because such a site does not interact with the viewer, as it is difficult to rob an airtight bank, but for a large forum or script program, When you log in, you need to pass the username and password to the server, even including your landing IP and browser and so on are the object of the program to crawl, crawl a server interaction process such as post and so you will find the browser and server data transmission between the, you may see included the submission of the form, Address bar parameters and so on, what you can't see, including cookie,http headers are the places where the data is submitted, which is the variable. These places are also the most primitive portals for server processing data. So how does a PHP program accept variables? All of the submitted variables are stored in PHP in a number of arrays, including
$_get
$_post
$_cookie
$_files
$_server
for initial convenience and flexibility, there is an option in PHP settings
register_globals
When this option is on, the variables that appear above will be part of the $globals, and can be used directly in the script without having to be made, and to
Variables_order
in order to overwrite. Many programs take into account the case of register_globals off, and then use the following code when the program is initialized:
@extract (Daddslashes ($_post));
@extract (Daddslashes ($_get));
The code plays a register_globals role in releasing post and get content as a global variable, but the danger may be greater, as mentioned later.
current 1/3 page
1 23 Next read the full text
