PHP

Encryption, as a security book, is usually a topic to be mentioned. The reason why I ignore the encryption problem in the main part of this book is that its usage is narrow, and developers should take a big look... Encryption As a security-related

When I write a book, php. netquickref. php lists a total of 3917 functions, including some syntax structures similar to functions. here I am not going to split them from the function area, but to make it... Function When I wrote this book, # I

This article mainly introduces serialization and deserialization in php to compress complicated data types into a single string. Serialize () encodes variables and their values into text form Unserialize () restore original variable Eg: $stooges =

In addition to reading arbitrary files on the shared server, attackers can create scripts that can browse the file system. Because most of your sensitive files are not stored in the home directory of the website, such scripts... File system

Password sniffing although attackers do not use network communication between your users and applications for access control, they must be aware that data exposure becomes more and more important, especially for authentication information. Use SSL...

If the source code exposes your WEB server, it must be able to read your source code and execute it. This means that when the code written by anyone is run by the server, it can also read your source code. The greatest risk on a shared

Command injection using system commands is a dangerous operation, especially when you try to use remote data to construct the command to be executed. If contaminated data is used, the command injection vulnerability is generated. Exec ()... Command

Remote File risk PHP has a configuration option named allow_url_fopen, which is valid by default. It allows you to point to many types of resources and process them like local files. For example, you can obtain... Remote File risks PHP has a

A particularly dangerous situation is when you try to use contaminated data as the leading part of dynamic inclusion: Code injection A particularly dangerous situation is when you try to use contaminated data as the leading part of dynamic

This article describes how php compresses web pages based on ob_start (ob_gzhandler). it involves some techniques related to function operation buffers and content compression such as ob_gzip and ob_start in php, for more information, see the next

Source code exposure an important issue about inclusion is the exposure of source code. The main cause of this problem is the following common situation: l use the. inc extension l & amp ;... Source code exposure An important issue about inclusion

The exposure of data concerning the database also requires the exposure of sensitive data. Whether or not you have saved your credit card number, social insurance number, or other data, you still want to confirm that the database is secure. & Amp;

This article explains how to implement unlimited classification under the thinkphp framework. the unlimited classification is generally used in the classification menu of a website. it is a common data structure and function. For more information,

Using self: or _ CLASS _ for static reference to the current CLASS depends on the CLASS that defines the current method: using static: is no longer parsed as the CLASS that defines the current method, it is calculated during actual operation. It can

This article mainly introduces the methods for adding, deleting, modifying, and querying PHP connections to MySQL, which has good reference value, next, let's take a look at it. This article mainly introduces the methods for adding, deleting,

I recently read the source code of the project and found that empty, isset, and is_null functions (language features) are in disorder in the source code. in some cases, it is obvious that they have been dug up. If you cannot understand these things

In PHP, the file lock and mysql table lock have the approximate usage, that is, only one person can operate at the same time, which avoids the operation of the same file by multiple people at the same time, this will cause data loss. next I will

HTTP request spoofing is a more advanced and complex attack method than spoofing forms. This gives attackers full control and flexibility. it further proves that they cannot blindly trust any data submitted by users .... HTTP request spoofing An

Output escape another Web application security is based on escaping the output or encoding special characters to ensure the original intent remains unchanged. For example, OReilly needs to be escaped before being transferred to the MySQL database...

Cross-site request forgery cross-site request forgery (CSRF) is an attack method that allows attackers to send arbitrary HTTP requests through victims. The victim referred to here is an uninformed accomplice, and all forged requests are initiated by