How to write Safe PHP code (1) _php tutorial

PHP is a very easy language to learn, and many people learn it without any programming background as a way to add some interactive elements to their website. Unfortunately, this often means that PHP programmers, especially those with newer web development programmers, are unaware of the potential security risks in their sites. Here are some of the more common security issues and how to avoid them.

Always, always trust your users.

Can't say enough times that you should always, ever, trust your users to send you the data you expect. I heard a lot of people respond, probably "oh, no malicious person will be interested in my website". This is wrong, there are always malicious users can take advantage of a security vulnerability, the problem can be easily discovered, because a user accidentally did wrong.

Therefore, all the Web pages of the development of the commandments, I can no longer compress the words is: forever, forever, trust your users. Assuming that your site collects every piece of data from the user containing malicious code, always, you think that you have checked the client to verify this data, for example in JavaScript, if you can achieve this goal, you should have a good start. If the security of PHP is important, this is important to learn, personally, "PHP security" is a major problem.

Global variables

In many languages, you must explicitly set a variable to use it. In PHP, there is an option ", Register_globals", which you can set in php.ini, so that you can use global variables without having to declare them beforehand.

Consider the following code:

if ($password = = "My_password") {$authorized = 1;} if ($authorized = = 1) {echo "Lots of important stuff.";}

Many people seem to feel no problem, and in fact, this code is applied throughout the site. However, if a server turns on "Register_globals". Then, simply add the "? authorized=1" url that will be visible to anyone. This is one of the most common security issues with PHP.

Fortunately, there are two simple solutions. First, perhaps best of all, is to turn "register_globals" off. Second, you have to be clear that only you use variables. In the example above, this would mean adding "? authorized=0"; At the beginning of the script:

$authorized = 0; if ($password = = "My_password") { $authorized = 1; } if ($authorized = = 1) { echo "Lots of important stuff."; }

Error message

Error messages are a very useful tool for both programmers and hackers. Developers need them to correct their mistakes. Hackers can use them to find out a variety of information about a website, from the directory structure of the server to the database login information. If possible, it is best to close all error reports. PHP can do the job. Htaccess or php.ini, set the value of "error_reporting" to "0". If you have a development environment, you can set different levels of error reporting.

1

http://www.bkjia.com/PHPjc/446661.html www.bkjia.com true http://www.bkjia.com/PHPjc/446661.html techarticle PHP is a very easy language to learn, and many people learn it without any programming background as a way to add some interactive elements to their website. Unfortunately, this often means ...

