PHP programmers are prone to 10 errors

Source: Internet
Author: User

Most of the 10 mistakes PHP programmers often make are related to security. Let's see what you 've done.

1. Do not translate HTML entities
A basic knowledge: All untrusted input (especially the data submitted by the user from the form) must be converted before output.
Echo $ _ Get ['usename'];
This example may be output:
<SCRIPT>/* script for admin password change or cookie setting */</SCRIPT>
This is an obvious security risk, unless you ensure that your users are correct.
How to fix:
We need to convert "<", ">", "and" to correct HTML representation (<,> ', and "), functions htmlspecialchars and htmlentities () this is exactly what we did.
The correct method:

echo htmlspecialchars($_GET['username'], ENT_QUOTES);

2. Ignore SQL input
I have discussed this problem in the simplest way to prevent SQL Injection in an article (in PHP + MySQL) and provided a simple method. Someone told me that they are already in PHP. set magic_quotes to on in ini, so you don't have to worry about this, but not all input is obtained from $ _ Get, $ _ post or $ _ cookie!
How to fix:
Like in the simplest method to prevent SQL injection (in PHP + MySQL), I recommend using the mysql_real_escape_string () function.

Correct practice:

<?php$sql = "UPDATE users SETname='.mysql_real_escape_string($name).'WHERE id='.mysql_real_escape_string ($id).'";mysql_query($sql);?>

3. the http-header-related functions are used incorrectly: Header (), session_start (), and setcookie ()
Have you ever encountered this warning? "Warning: cannot add header information-headers already sent [...]

Each time you download a webpage from the server, the server's output is divided into two parts: the header and the body.
The header contains some non-visual data, such as cookies. The header always arrives first. The body contains visualized HTML, images, and other data.
If output_buffering is set to off, all http-header-related functions must be called before output. The problem is that when you develop data in one environment and deploy the data in another environment, the output_buffering settings may be different. The result is switched to stopped. The cookie and session are not properly set .........

How to fix:
Make sure that the http-header-related function is called before the output, and make output_buffering = OFF.

4. Insecure data is used for require or include files.
Again, do not trust data that is not explicitly declared by yourself. Do not include or require files obtained from $ _ Get, $ _ post, or $ _ cookie.
For example:
Index. php

<?//Include only files that are allowed.$allowedFiles = array('file1.txt','file2.txt','file3.txt');if(in_array((string)$_GET['filename'],$allowedFiles)) {include($_GET['filename']);}else{exit('not allowed');}?>

5. Syntax Error
Syntax errors include all lexical and syntax errors, which are so common that I have to list them here. The solution is to carefully study the PHP syntax and avoid missing a bracket, braces, semicolons, and quotation marks. There is another way to change the editor, so don't use Notepad!
6. Rarely used or not object-oriented
Many projects do not use PHP's object-oriented technology. As a result, code maintenance becomes very time-consuming and labor-consuming. PHP supports more and more Object-oriented technologies, and it is getting better and better. We have no reason not to use object-oriented technology.
7. Do not use the framework
95% of PHP projects are doing the same four things: create, edit, list, and delete. Now there are many MVC frameworks to help us complete these four things. Why don't we use them?
8. I do not know the existing functions in PHP.
The core of PHP contains many functions. Many programmers repeatedly invent the wheel. A lot of time is wasted. Search for PHP mamual Before encoding, and search for it on Google. There may be new discoveries! Exec () in PHP is a powerful function that can execute cmd shell and return the last line of the execution result as a string. For security considerations, you can use escapeshellcmd ()
9. Use the old version of PHP
Many programmers are still using PhP4. The development on PhP4 cannot fully utilize the potential of PHP, and there are still some security risks. It does not take a lot of effort to go to PhP5. Most PhP4 programs can be migrated to PhP5 as long as few statements are modified or even no changes are required. According to the, only 12% of PHP servers use PhP5, so 88% of PHP developers are still using php4.
10. quote the quotation marks twice.
Have you ever seen \ 'or \' in the webpage? This is usually because magic_quotes is set to off in the developer's environment, while magic_quotes = on. php will repeatedly run addslashes () on the data in get, post, and cookie on the deployed server ().
Original text:
It's a string

Magic quotes on:
It \'s a string

Run again
Addslashes ():
It \'s a string


HTML output:
It \'s a string

Another case is that the user entered the wrong login information at the beginning. After the server detects the wrong input, the same form is output and the user needs to input it again, causing the user's input to be converted twice!

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.