Discussion on PHP variable security

I originally wanted to write a long document. Later I thought this was already very skillful by many cool people, so I just want to give a brief introduction to it.

I remember that when I first came into contact with PHP security, I asked some experts how to get started. They always told me to visit the PHP manual. Security is the foundation.

That's right. What I want to talk about is explained in detail in the PHP Manual: workshop!

Variable variables are a very convenient feature of PHP. As mentioned in the manual, variable variables mean that variable names can be dynamically set!

So what security issues will occur when the variable name can be dynamically set? Let's take a look:

<? Php
$ A = 'phpinfo ';
$ ();
?>

This code is easy to understand. The type of the variable is character-type phpinfo. The variable is dynamically added with (), so the variable is changed to the phpinfo function for dynamic execution!

 

Following the same principle, we reference the example of variable variables in the manual:

<? Php
$ A = 'phpinfo ';
$ {$ ()};
?>

$ A () is a dynamic function that contains dynamic variables. Of course, I am a little unprofessional about it or variable variables. We will find that the phpinfo function is still executed!

 

If you have read the manual and the example I have given, you will surely think this is not magical. This is the syntax feature of PHP, and then we will scale this thing into one line:

<? Php

$ A = "$ {$ {phpinfo ()}}";

?>

This is a nested variable. We just enter the variable content in the previous example. In fact, a function is actually assigned to a variable, as a result, the phpinfo function is finally executed and becomes a prototype of various vulnerabilities and webshells!

 

You should know why I was asked to go to the PHP manual at the beginning. However, this article is over now. I also missed a point. Daniel said that security is the foundation, we haven't figured out why the variables in the previous example use single quotation marks, and the final example uses double quotation marks. If you think of this question, I think you must have great potential for security. In the future, it will be a great opportunity to be inaccurate!

 

The difference between single quotes and double quotes in PHP is still related to variables. Let's look at the example below:

<? Php
$ A = 'phpinfo ()';
Echo $ a; // output the phpinfo () String
Echo '$ a'; // output $ a string
Echo "$ a"; // output the phpinfo () String
?>
The content in double quotation marks is parsed by PHP syntax, And the content in single quotation marks is directly identified as a string!

 

So this article is really over here, so everyone should understand why the cool-man told me to read more PHP manuals and security is the basic idea.

 

From: RAyh4c Black Box