Please have experienced PHP veteran, the security of the program!

Consult an experienced PHP veteran, the security of the program!?
Discussion under the development of PHP Web site, in addition to the operating system and Web services software, in the program itself security should pay attention to those

Remember the first time to customers to do the station 1 months was the villain to black, check found incredibly in the top of the homepage was added, the result is the old bomb ads. It may be due to a procedural vulnerability.

Also heard that ICBC's website was spoof, and so on.

Checheras
！




------Solution--------------------
Oh, let's have some practical
/*
* Anti-injection treatment
*/
if (!GET_MAGIC_QUOTES_GPC ()) {
Immit (___fckpd___0
POST);
Immit (___fckpd___0
GET);
Immit (___fckpd___0
Cookies);
}
Anti-injection processing (adding a slash to a variable) function
Parameter $array is an array of anti-injection variables
Function Immit (& $array) {
foreach ($array as $key = = $value) {
if (!is_array ($value)) {
$array [$key]=addslashes ($value);
}else{
Immit ($array [$key]);
}
}
}


How to avoid SQL injection attacks in PHP


if (!GET_MAGIC_QUOTES_GPC ()) {
Calluserfunc (___fckpd___0
GET, ' addslashes ');
Calluserfunc (___fckpd___0
POST, ' addslashes ');
}
You can, field value plus ' on it, such as query article
"SELECT * FROM table WHERE id= ' $id '"

------Solution--------------------
General attention to the following items:
Scripting attacks (not much harm is mostly to the client).
Resolution: The user's published text is treated with htmlspecialchars.

SQL injection.
Solve:
It's a good idea to open GET_MAGIC_QUOTES_GPC. Replace the data that the user transmits in post or get mode with addslashes.
or limit the length of the transmitted data within a safe range (e.g., limit 1-2 char lengths),
Or strictly check the type of data transmitted by the user. I've seen someone detect keywords within an ASP this is a workaround, but inefficient.

Upload vulnerability:
Solve:
Check user transfer file size, limit its size
Check the type of user transfer file, never allow the user to pass Apache will interpret the file (detection file suffix can be)

Back-part Restore vulnerability:
Solve:
Manage the Administrator password. Do log

The above is my summary of some of the hacker commonly used attack methods, there is no way I hope you add, Exchange.

