Website anti-injection with the hanging horse PHP. INI Security Settings _php Tutorial

When you want to prevent a page attack, you can include an anti-attack file on the head of the page, like a generic anti-injection file. We can do it in three situations:
1. Reference within each file. Such a file is possible, but it is inconvenient if there are hundreds of files in a website.
2. Refer to the common inclusion file, such as config.inc.php tutorial. This is a good way, but also the current market more popular practice.
3, quoted in the php.ini. In the configuration file reference, will affect all the site, including all pages, this is like some of the popular free space quotient, when you open a free ftp space, upload the site, the space will appear in the same ad. I don't know if this is the way, but the purpose is the same. The advantage of this is that it is safe and easy to maintain if it is a company or an intranet site.

The first two methods are clear, and the third is in php.ini, find this section:

; Automatically add files before or after any PHP document.
; auto_prepend_file = "phpids.php"
; auto_append_file = "alert.php"

The default is empty, please add the included files.
Also find:

; Unix: "/path1:/path2"
; include_path = ".:/ Php/includes "
;
; Windows: "Path1;path2"
include_path = ".; F:phpnowhtdocs "

Because my is the win environment, so the Windows option is turned on, including the path can be freely modified. At the same time, such a function also for our attack also caused the convenience, such as hanging horse. Now the "market" also has a lot of horse-hanging skills, not much to say. We can use the Auto_prepend_file option, to bulk hanging horse, the entire server can be hung on the site, the advantage is: not affect the speed, not modify the file, novel method. The disadvantage is: must have write permission to php.ini.

http://www.bkjia.com/PHPjc/629729.html www.bkjia.com true http://www.bkjia.com/PHPjc/629729.html techarticle when you want to prevent a page attack, you can include an anti-attack file on the head of the page, like a generic anti-injection file. We can do it in three different situations: 1, in each file reference. This ...

