PHP Security Filtering _php Tutorial

PHP Security Filtering

/*ansic Code-url Code table: http://www.w3school.com.cn/tags/html_ref_urlencode.html

--------------------------------------------------------------------------------------------------------------- --

1, verify the filter user input

Even the most common alphanumeric input can be dangerous, listing several characters that are prone to security problems:

!$ ^ & * () ~ [] \ | { } ' " ; < >? - `

Characters that may have special meaning in the database:

'" ; \

There are also non-printable characters:

Character \x00, or ASCII 0,null or false

Characters \x10 and \x13, or ASCII 10 and 13,\n \ r

Character \x1a or ASCII 26, indicating the end of the file

Entering the wrong parameter type can also cause unexpected errors in the program.

Entering too many parameter values can result in errors such as overflow.

2. Filtering the path and name of the file

The file name cannot contain binary data, which may cause problems.

Some systems allow Unicode multibyte-encoded file names, but try to avoid the ASCII characters that should be used.

Although UNIX systems can use almost any symbol in the file name setting, you should use-and _ to avoid using other characters as much as possible.

You also need to limit the length of the file name.

3. Prevent SQL injection

Check the type of user input that can be used when the user enters a number as follows:

Use the Is_int () function (or Is_integer () or Is_long () function)

Use the GetType () function

Use the Intval () function

Use the Settype () function

Check the length of the user input string using the strlen () function.

To check if the date or time is valid, you can use the Strtotime () function

4. Prevent XSS attacks

A common method of XSS attack is to inject HTML elements to execute the JS script, and PHP has built in some defensive functions (such as htmlentities or Htmlspecialchars).

5, filter the user submitted URL

If a user is allowed to enter a URL to invoke an image or link, you need to ensure that he does not pass in javascript: or VBScript: or data: Non-HTTP protocol.

You can use the PHP built-in function Parse_url () function to split the URL and then make a judgment.

6. Prevent remote execution-The following table lists some of the characters associated with the shell:

Remote execution is usually performed using PHP code such as the eval () function, or it is called a command execution such as exec (), PassThru (), Proc_open (), Shell_exec (), System (), or Popen ().

Inject PHP Code: PHP provides developers with a lot of ways to invoke the Allow PHP script, we need to pay attention to user-controllable data filtering.

7. Shell command execution

PHP provides a number of functions that can execute system commands directly, such as the EXEC () function or ' (anti-quote).

The Safe mode of PHP provides some protection, but there are some ways to bypass Safe mode:

1, upload a Perl script, or Python or ruby, server-supported environment, to execute scripts in other languages can bypass PHP security mode.

2, using the system buffer overflow vulnerability, bypassing the security mode.

Some of the characters associated with the shell:

Name character ASCII 16 binary URL encoded HTML encoding

NewLine \x0a%0a

Exclamation marks! \X21%21!

Double quotes "\x22%22" or "

Dollar sign $ \x24%24 $

Connectors & \x26%26 & or & #amp

Single quote ' \x27%27 '

Opening parenthesis (\x28%28 (

Closing parenthesis) (\x29%29)

Asterisk * \x2a%2a *

Hyphenation Symbol-\x2d%2d-

Semicolon \X3B%3b;

Left angle brackets < \x3c%3c <

Right angle bracket > \x3e%3e >

Question mark? \x3f%3f?

Left bracket [\x5b%5b [

backslash \ \x5c%5c \

Right bracket] \x5d%5d]

Caret ^ 94 \x5e%5e ^

Anti-quote ' \x60%60 '

Left Curly brace {123 \x7b%7b {

Pipe symbol | 124 \x7c%7c |

Right curly brace} \x7d%7d}

Wave number ~ 126 \x7e%7e ~

--------------------------------------------------------------------------------------------------------------- --

Security Filter Function Code */

/**

* Safe filter input [JB]

*/

function Check_str ($string, $isurl = False)

{

$string = preg_replace ('/[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f]/', ' ', $string); Remove control characters

$string = Str_replace (Array ("n", "%00", "\ R"), "', $string),//\0 denotes ASCII 0x00 characters, usually as a string end flag; All three of them are potentially harmful characters.

Empty ($isurl) && $string =preg_replace ("/& (?! (#[0-9]+| [a-z]+];)/si ", ' & ', $string);//html can be used & #xxx, to encode some characters, such as (space),? Unicode characters, etc., A (?! b) indicates that a is not followed by a B, so the author wants to keep it? Similar HTML encoded characters, removing other problematic characters

$string = Str_replace (Array ("%3c", ' < '), ' < ', $string); ASCII ' < ' turns into ' < ';

$string = Str_replace (Array ("%3e", ' > '), ' > ', $string);

$string = Str_replace (' "'," ' "," \ T "," '), Array (' "', '" ', ', '), $string);

Returntrim ($string);

}

/**

* Safety Filter Class-filter javascript,css,iframes,object and other unsafe parameters high filter level

* @param string $value The value to filter

* @return String

*/

function Fliter_script ($value) {

$value =preg_replace ("/(javascript:)?" On (Click|load|key|mouse|error|abort|move|unload|change|dblclick|move|reset |resize|submit)/I "," &111n\\2 ", $value);

$value = Preg_replace ("/(. *?) <\/script>/si "," ", $value);

$value = Preg_replace ("/(. *?) <\/iframe>/si "," ", $value);

$value = Preg_replace ("//iesu", "', $value);

Return$value;

}

/**

* Safe Filter Class-Filter HTML tags

* @param string $value The value to filter

* @return String

*/

function fliter_html ($value) {

if (function_exists (' Htmlspecialchars ')) return Htmlspecialchars ($value);

Returnstr_replace (Array ("&", ' "'," ' "," < "," > "), Array (" & "," \ "", "'", "<", ">"), $value);

}

/**

* Security filtering class-underline incoming data to prevent SQL injection

* @param string $value The value to filter

* @return String

*/

function Fliter_sql ($value) {

$sql = Array ("Select", ' Insert ', "Update", "delete", "\", "\/\*", "\.\.\/", "\.\/", "union", "into", "Load_file", "outfile ");

$sql _re=array ("," "," "," "," "," "," "," "," "," "," "," ");

Returnstr_replace ($sql, $sql _re, $value);

}

/**

* Security Filter Class-Universal Data filtering

* @param string $value the variable to be filtered

* @return String|array

*/

function Fliter_escape ($value) {

if (Is_array ($value)) {

foreach ($value as $k = = $v) {

$value [$k]= self::fliter_str ($v);

}

}else {

$value = Self::fliter_str ($value);

}

Return$value;

}

/**

* Security Filter Class-string filter filter special have harmful characters

* @param string $value The value to filter

* @return String

*/

function Fliter_str ($value) {

$badstr = Array ("n", "%00", "\ R", ' & ', ', ' "'," ' "," < "," > "," ","%3c ","%3e ");

$newstr = Array (', ', ', ', ' & ', ', ' ', ', ', ' < ', ' > ', ' ', ' < ', ' > ');

$value = Str_replace ($badstr, $newstr, $value);

$value =preg_replace ('/& (# (\d{3,5}|x[a-fa-f0-9]{4});)/', ' &\\1 ', $value);

Return$value;

}

/**

* Private Road strength security conversion

* @param string $fileName

* @return String

*/

function Filter_dir ($fileName) {

$tmpname = Strtolower ($fileName);

$temp = Array (':/', "\ n", "..");

if (Str_replace ($temp, ', $tmpname)!== $tmpname) {

Returnfalse;

}

Return$filename;

}

/**

* Filter Catalogue

* @param string $path

* @return Array

*/

Public Function Filter_path ($path) {

$path = Str_replace (Array ("'", ' # ', ' = ', ' ', ' $ ', '% ', ' & ', '; '), ', $path);

Returnrtrim (Preg_replace (\/) {2,}| ( \\\) {1,}/', '/', $path), '/');

}

/**

* Filter PHP tags

* @param string $string

* @return String

*/

Public Function Filter_phptag ($string) {

Returnstr_replace (Array ("), Array (' ), $string);

}

/**

* Safe Filter Class-return function

* @param string $value The value to filter

* @return String

*/

Public Function Str_out ($value) {

$badstr = Array ("<", ">", "%3c", "%3e");

$newstr = Array ("<", ">", "<", ">");

$value = Str_replace ($newstr, $badstr, $value);

Returnstripslashes ($value); Underline

}

http://www.bkjia.com/PHPjc/1055558.html www.bkjia.com true http://www.bkjia.com/PHPjc/1055558.html techarticle PHP Security Filter/*ansic code-url Code table: http://www.w3school.com.cn/tags/html_ref_urlencode.html----------------------------- ------------------------------------------------------...

