Php programming Security Guide

1. General1) lamp System Security Settings 2) php. ini Security Settings 3) use the MVC Framework2. Data Transmission1) In $ _ GET's $ _ POST, $ _ COOKIE, and $ _ REQUEST, manipulate all data contained in the data programmatically before disinfection and verification. 2) SQL Injection definition: code injection technology, which uses a security vulnerability to occur at the application database layer. This vulnerability exists. When an SQL statement or user input is not strong in an incorrect character string escape character, filtering is performed unexpectedly. Prevention: mysql_real_escape_string ($ string) 3) cross-site scripting (XSS) Definition: a security vulnerability that allows malicious Web users to inject code when other users in a web application browse the webpage. This example includes client scripts (JavaScript. Prevention: htmlentities (strip_tags ($ string ))3. browser requests1) Cross-Site Request Forgery (CSRF) Definition: Attacks work by including links or scripts on pages authorized to users. For example, Bob, a website user, may be browsing a chat forum, and Alice, another user, is also in the Forum. The latter has just published an image message with a bank link of Bob. Assume that Alice has compiled a form submission link on Bob's bank site, and uses this link as an Image tag. If Bob's bank saves his authorization information in the cookie and the cookie does not expire, Bob will submit the withdrawal form and his cookie when trying to load the image, in this way, the transaction is authorized without Bob's consent. Prevention: generate a unique "token", usually at the beginning of a browser session. The token is used in all POST and GET requests. Following the POST/GET action, check the existing session token and confirm that the mail token/GET is the same as the token stored in the session. (Like the MVC Framework of CakePHP, this makes it easier to unify the entire application .)4. Sessions1) when a session is killed, the session data is destroyed. When the session is completed ("deregistered"), the data is destroyed, not just the cookie is cleared, otherwise, the malicious user can restore the cookie and use the session again. You can leave all indexes in $ _ SESSION blank. 2) the default path for storing session files on the website or storing session files in the database on the server can be hijacked, especially in a shared host environment.5. Password1) strong passwords require numbers, symbols, and uppercase and lowercase letters. The password length should be between 12 and 14 characters. 2) use SHA1 () for encryption at least () hash encryption (md5 () is not used. The hash () function provides some additional hash options, including SHA256. Add a "Specific Application" for encryption6. General php. ini configuration1) Disable register_globals prevention: register_globals = Off 2) Disable magic quotes prevention: magic_quotes_gpc = Off 3) Disable error reporting Prevention: display_errors = Off 4) enable error logging and save log file to a directory abve web root prevention: log_errors = On; ignore_repeated_errors = On; html_errors = Off; error_log =/path/above/webroot/logs/php_error_log 5) Save session data to the webroot directory to prevent: session. save_path =/path/above/webroot/sessions7. The. htaccess file downloaded by webroot1) Disable directory listings site-wide prevention: Options-Indexes8. Important/sensitive files1) prevent unauthorized access/download. This includes website management/members and some website/database configuration files. 2) use the script file as an intermediary and as an attachment. 3) constantly update the passwords of your scripts (WordPress, phpMyAdmin, and so on. 4) when you are using phpMyAdmin, you can use phpMyAdmin to allow access. This prevents others from cracking the zero-day vulnerability by exploiting the zero-day vulnerability) it is also called a zero-time-difference attack, which is a security vulnerability that is immediately exploited after being detected. In general, security patches and flaws are exposed within the same day, and related malicious programs appear. Such attacks are often sudden and destructive.9. File Upload1) Verify $ _ FILES before data operations to determine whether the file is already in $ _ FILES. 2) please note that the provided MIME type may be spoofed or lead to his/her mode error. 3) All files uploaded by users should be moved to a directory above the root directory of the website. 4) do not execute files uploaded by users, or use include require or other files uploaded by users. 5) do not set the script type to application/octet-stream, "" application/unknown, "or" plain/text"10. Others"Utility" files/programs created and used by website developers under webroot. If they are not intended to be accessed and used by website users, therefore, all of them should be deleted before they are put on the Internet to reduce the security risks of the website.