PHP Magic Quotes brings security issues analysis, Magic quotes _php Tutorial

PHP Magic Quotes brings security issues analysis, magic quotes

The "\" character generated by PHP by extracting magic quotes poses some security problem, such as the following snippet:

Foo.php?xigr= ' Ryatfunction daddslashes ($string, $force = 0) {!defined (' MAGIC_QUOTES_GPC ') && define (' Magic_ QUOTES_GPC ', GET_MAGIC_QUOTES_GPC ()); if (! MAGIC_QUOTES_GPC | | $force) {if (Is_array ($string)) {foreach ($string as $key = = $val) {$string [$key] = Daddslashes ($val, $force);}} else {$s Tring = Addslashes ($string);}} return $string;} ... foreach (Array (' _cookie ', ' _post ', ' _get ') as $_request) {foreach ($$_request as $_key = $_value) {$_key{0}! = ' _ ' &A mp;& $$_key = daddslashes ($_value);}} echo $xigr [' Hi '];//echo \

The above code originally expected to get an array variable $xigr[' Hi ' after daddslashes (), but did not make strict type rules on the variable $xigr, when we commit a string variable $xigr= ' Ryat, after the above processing becomes \ ' Ryat , the last $xigr[' Hi ' will output \, if this variable is introduced to the SQL statement, then it will cause serious security problems, and then look at the following code snippet:

... if ($XIGR) {foreach ($xigr as $k = = $v) {$uids [] = $v [' uid '];} $query = $db->query ("Select UID from the Users WHERE uid in (') '. Implode (" ', ' ", $uids).

Using the above mentioned ideas, by submitting foo.php?xigr[]= ' &xigr[][uid]=evilcode such a form of construction can easily break through GPC or similar security treatment to form a SQL injection vulnerability! Should give enough attention to this!

[PHP Learning] teaches 1 Magic quote correction functions

Thanks, the basic understanding, this function should be: If the Magic quote function open, it adds the backslash to remove, and then according to the situation itself with addslashes () or mysql_real_escape_string () to deal with.

thinkphp for PHP Magic quotes I just upload a link or a picture or something, and give me a "/" fix.

I want to make sure that the value you pass in is "/", and if it is "/", you can try to replace "/" in the action with empty.
The value I passed over before was "\", so I used the stripslashes ($_post[' ck ') to fix it.

http://www.bkjia.com/PHPjc/840626.html www.bkjia.com true http://www.bkjia.com/PHPjc/840626.html techarticle PHP Magic quotes brought about by the security problem analysis, Magic quotes PHP by extracting magic quotes produced by the "\" character will bring some security issues, such as the following snippet://FO ...

