Home > Tutorials > PHP Tutorials

PHP-protected file system specific code sharing _php tutorial

Source: Internet
Author: User
Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞
File systems are very important to any site, and programmers are sparing no effort to protect their systems from being violated. Today we will explain the specific code examples of the PHP protection file system. There was a Web site that disclosed customer data that was stored in a file in the Web server. A visitor to the Web site uses the URL to view the files that contain the data. Although the file was misplaced, this example highlights the importance of protecting the file system against attackers.

  • The application arbitrarily processes the file and contains variable data that the user can enter, and carefully examines the user input to ensure that the user cannot perform any inappropriate actions on the file system. Listing 1 shows an example of a PHP site that downloads an image with the specified name.

       
   
      
    
    
    1. 
    
    2.  Php 
      3. 
    
    
    3. 
    
    4. if ($_post[' submit '] = = ' Download ') {
      5. 
    
    
    5. 
    
    6.  $ file = $_post[' fileName ']; 
      7. 
    
    
    7. 
    
    8. Header ("Content-type:application/x-octet-stream");
      9. 
    
    
    9. 
    
    10. Header ("Content-transfer-encoding:binary");
      11. 
    
    
    11. 
    
    12. header ("Content-disposition:attachment; filename = "". $file. "";" ); 
      13. 
    
    
    13. 
    
    14.  $ FH  =  fopen ($file, ' R '); 
      15. 
    
    
    15. 
    
    16. while (! feof ($FH))
      17. 
    
    
    17. 
    
    18. {
      19. 
    
    
    19. 
    
    20. Echo (Fread ($FH, 1024));
      21. 
    
    
    21. 
    
    22. }
      23. 
    
    
    23. 
    
    24. Fclose ($FH);
      25. 
    
    
    25. 
    
    26. } else {
      27. 
    
    
    27. 
    
    28. Echo ("<html><head>< "); 
      29. 
    
    
    29. 
    
    30. Echo ("title>Guard your filesystem  title> c19>  head> "); 
      31. 
    
    
    31. 
    
    32. Echo ("<body><form    ID = "Myfrom" Action = "". $_server[' php_self '. 
      33. 
    
    
    33. 
    
    34.  ""  Method = "POST" > "); 
      35. 
    
    
    35. 
    
    36. Echo ("<Div><input    type= "text"  name= "FileName"  value= ""); 
      37. 
    
    
    37. 
    
    38. Echo (isset ($_request[' filename '])? $_request[' filename ']: ');
      39. 
    
    
    39. 
    
    40. Echo ( " />"); 
      41. 
    
    
    41. 
    
    42. Echo ("<input    type=" Submit "  value  = "Download"  name= "Submit"   />  Div >   "); 
      43. 
    
    
    43. 
    
    44. Echo ("  form>  body>  html  >   "); 
      45. 
    
    
    45. 
    
    46. }
      47.

    As you can see, the more dangerous script in Listing 1 will handle all the files that the WEB server has read access to, including the files in the Session directory (see "Securing Session Data"), and even some system files (such as/etc/passwd). For a php-protected file system demonstration, this example uses a text box that allows the user to type a file name, but can easily provide a file name in the query string.

    While configuring user input and file system access is risky, it is a good idea to design your application to use the database and hide the generated file names to avoid simultaneous configuration. However, this does not always work. Listing 2 provides a sample routine to verify the file name. It will use regular expressions to ensure that only valid characters are used in the file name, and specifically check for dot characters: ...

     
    
    
      
  
     
     
    1. function Isvalidfilename ($file) { 
      2. 
  
     
     
    2.  /* don ' t allow. and allow any "word" character /* * 
      3. 
  
     
     
    3.  Return Preg_match ('/^ (?:.) (?!.))| W) +$/', $file); 
      4. 
  
     
     
    4.

    The above is the article for everyone to share the PHP protection file system specific code to write.


    http://www.bkjia.com/PHPjc/446399.html www.bkjia.com true http://www.bkjia.com/PHPjc/446399.html techarticle file systems are very important to any site, and programmers are sparing no effort to protect their systems from being violated. Today, we will explain the PHP protection text for you ...

This article is an English version of an article which is originally in the Chinese language on aliyun.com and is provided for information purposes only. This website makes no representation or warranty of any kind, either expressed or implied, as to the accuracy, completeness ownership or reliability of the article or any translations thereof. If you have any concerns or complaints relating to the article, please send an email, providing a detailed description of the concern or complaint, to info-contact@alibabacloud.com. A staff member will contact you within 5 working days. Once verified, infringing content will be removed immediately.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

  • Sales Support

    1 on 1 presale consultation

    Chat Contact Sales

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

    Open a Ticket

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

    Learn More