PHP intval function Security Application Tips _php Tutorial

We learn

First, PHP intval function description

The Intval function has a feature: "Until a number or sign is encountered to start the conversion, and then the non-numeric or end of the string () end Conversion", in some applications due to the Intval function This feature is not known enough, the use of errors caused by bypassing some security decisions lead to security vulnerabilities.

Second, PHP intval function analysis

1. Php_function (Intval)
2. {
3. Zval **num, **arg_base;
4. int base;
5. Switch (Zend_num_args ()) {
6. Case 1:
7. if (ZEND_GET_PARAMETERS_EX (1, &num) = = FAILURE) {
8. Wrong_param_count;
9. }
10. Base = Ten ;
11. Break

When the Intval function accepts that the string parameter is called convert_to_long_base () processing, the next call is Z_lval_p (OP) = Strtol (Strval, NULL, Base), and the parameter is handled by the Strtol function.

The PHP intval function is prototyped as follows:

Long int strtol (const char *nptr,char **endptr,int base);

This function converts the parameter nptr string based on the parameter base to the number of growth integers, the parameter base range from 2 to 36, or 0. The parameter base represents the input method used, such as the base value of 10 is 10, if the base value of 16 is used 16.

The process is:

Strtol () scans the parameter nptr string, skips the preceding space character until a number or sign is encountered, and then ends the conversion with a non-numeric or string end () and returns the result.

Then when the intval is used in the judgment of if and so on, it will cause this judgment to be meaningful, leading to a security breach.

Third, PHP intval function test code

 
  
  

  
   
   
intval.php 
  
   
   
$ var = "20070601" ; 
  
   
   
if (Intval ($var)) 
  
   
   
echo "It ' s safe"; 
  
   
   
Echo ' $ var = '. $var; 
  
   
   
echo " 
  
   
   
"; 
  
   
   
$ var1 = "1 Union Select 1,1,1 from admin" ; 
  
   
   
if (Intval ($var 1)) 
  
   
   
echo "It ' s safe too"; 
  
   
   
Echo ' $ var1 = '. $var 1; 
  
   
   
?>
 
  
  

Four, PHP intval function Practical application

WordPress <= 2.0.6 wp-trackback.php zend_hash_del_key_or_index/sql injection Exploit

http://www.bkjia.com/PHPjc/446049.html www.bkjia.com true http://www.bkjia.com/PHPjc/446049.html techarticle we learn one, PHP intval function describes the Intval function has a feature: until the number or sign to start the conversion, and then encountered a non-numeric or string end () end of the conversion, in some ...

