Sort out some PHP Development security issues and some PHP Development Security issues
Php provides developers with great flexibility, but it also brings potential risks to security issues. we need to summarize the previous problems in the near future, here, I would like to summarize some of my development feelings by translating an article.
When developing an Internet service, you must always keep in mind the security concept and embody it in the developed code. The PHP scripting language is not concerned with security issues, especially for most inexperienced developers. Every time you talk about any transactions involving money and transactions, you need to pay special attention to security issues, such as developing a forum or a shopping cart.
General points of security protection
Do not trust the form
Do not trust users
Assume that every piece of data received by your website has malicious code and hidden threats. clean up every piece of data.
Disable global variables
Configure the following in the php. ini file:
register_globals = Off
If this configuration option is enabled, there will be a great security risk. For example, a script file of process. php inserts the received data into the database. the form for receiving user input data may be as follows:
In this way, when the data is submitted to the process. php registers a $ username variable and submits the variable data to process. php. this variable is set for any POST or GET request parameters. The following problem occurs if initialization is not performed on the display (refer to: http://www.lai18.com/content/434606.html)
Assume that the authenticated_user function is used to determine the value of the $ authorized variable. if the register_globals configuration is enabled, any user can send a request, to set the value of the $ authorized variable to any value to bypass this verification.
All the submitted data should be obtained through the predefined global array of PHP, including $ _ POST, $ _ GET, $ _ FILES, $ _ SERVER, and $ _ REQUEST, $ _ REQUEST is a federated variable of $ _ GET/$ _ POST/$ _ COOKIE arrays. the default sequence is $ _ COOKIE, $ _ POST, and $ _ GET.
Recommended security configuration options
Error_reporting is set to Off: do not expose error information to users. you can set it to ON during development.
Set safe_mode to Off.
Set register_globals to Off.
Disable the following functions: system, exec, passthru, shell_exec, proc_open, and popen.
Open_basedir is set to/tmp, so that session information can be stored and a separate website root directory can be set.
Set expose_php to Off
Set allow_url_fopen to Off.
Set allow_url_include to Off.
SQL injection attacks
Pay special attention to security when operating SQL statements in the database, because the user may enter a specific statement to change the functions of the original SQL statement. For example:
Collect and collect technical articles from the PHP Security programming series
The PHP Security programming series favorites have collected knowledge about PHP Security programming and provide a learning reference for PHP Security programming.
1discuz php prevents SQL injection functions
2php methods to prevent xss attacks
3PHP Secure Programming: escape the output
4PHP Secure Programming: Filter user input
5PHP Secure Programming: availability and data tracking
6PHP Secure Programming: Do not let irrelevant people see the error message
7 PHP Secure Programming: Security of register_globals
8 PHP Security programming: Some Principles of website security design
9PHP Secure Programming: About form spoofing submission
10PHP Secure Programming: HTTP request spoofing
11PHP Secure Programming: do not expose database access permissions
12PHP Secure Programming: defense against cross-site request forgery (CSRF)
13PHP Secure Programming: Form and data security
14PHP security Programming: attacks from URL semantics
15 PHP Secure Programming: defense against File upload attacks
16PHP security Programming: defense against cross-site scripting attacks
17PHP Secure Programming: Fixed session acquisition of valid sessions
18PHP Secure Programming: prevents SQL injection
19PHP Secure Programming: session hijacking due to cookie exposure
20 PHP Secure Programming: prevent Source code exposure
21PHP Secure Programming: pay attention to backdoor urls
22PHP security programming: session hijacking defense
23PHP security Programming: brute-force cracking
24PHP security Programming: password sniffing and replay attacks
25PHP security programming: Keep in mind the security practices of logon status
26PHP Secure Programming: shell command injection
27PHP Secure Programming: risks of opening remote files
28PHP security Programming: file directory prediction vulnerability
29PHP Secure Programming: prevents file name manipulation
30PHP Secure Programming: File-contained code injection attacks
31PHP Secure Programming: better session data security
32PHP Secure Programming: Source code security for shared hosts
33PHP Secure Programming: Session Data injection
34PHP Secure Programming: host file directory browsing
35PHP security Programming: PHP Security mode
36php security: GET the value directly with $ instead of the $ _ GET character escape
37php vulnerability prevention policy to create high-performance web
38 what XSS attacks? PHP functions to prevent XSS attacks
39 parsing php methods to prevent repeated form submissions
40php secure append
41PHP prevents cross-origin submission forms
42php prevents SQL injection
43php prevents SQL injection code instances
44php prevents SQL injection sample analysis and regular expressions for several common attacks
45PHP security prevents exposure of your source code or important configuration information
46PHP simple example of preventing repeated data submission by post
47php prevents counterfeit data from being submitted from the URL
Summary of several common methods for preventing repeated submission of forms in 48PHP
49php: how to prevent counterfeit data from being submitted from the address bar URL
50php prevents remote form submission outside the site
51php prevents SQL injection to filter paging parameter instances
52PHP security-attacks and solutions to Apache installation
53PHP security-file system security and prevention measures
54PHP security-file system security ?? Null character
55PHP security-database security ?? SQL injection and prevention measures
56PHP Security overview and general rules
57PHP security-possible attacks and solutions during CGI installation
58PHP security-user-submitted data
59PHP security-database security ?? Design, connection, and encryption
60PHP security magic quotes ?? What are magic quotes and how to use them?
61PHP security-hiding the PHP script extension
Use Register Globals for 62PHP security
63PHP security error report
64php methods to prevent malicious refresh and ticket refresh
65php methods to prevent websites from being refreshed
Summary of 66PHP website Common security vulnerabilities and corresponding preventive measures