For example, the following Web app may display sensitive information to logged-in users:
Copy the Code code as follows:
$authenticated = FALSE;
$authenticated = Check_auth ();
if ($authenticated)
{
Include './sensitive.php ';
}
?>
Because Sensitive.php is located in the home directory of the Web site, it can be accessed directly by the browser by skipping the authentication mechanism. This is because all files in the home directory of the Web site have a corresponding URL address. In some cases, these scripts may perform an important operation, which increases the risk.
To prevent backdoor URLs, you need to confirm that all included files are saved outside the home directory of the website. All files saved in the home directory of the Web site must be accessed directly through the URL.
http://www.bkjia.com/PHPjc/825129.html www.bkjia.com true http://www.bkjia.com/PHPjc/825129.html techarticle For example, the following Web app might display sensitive information to a logged-in User: Copy code code like this:? php $authenticated = FALSE; $authenticated = Check_auth (); if ($authenticated) { Inclu ...
