PHP Security - Backdoor URL

Backdoor URL

A backdoor URL refers to a resource that can be accessed directly through the URL without being directly called. For example, the following WEB application may display sensitive information to logged-in users:

<?php
 
  $authenticated = FALSE;
  $authenticated = check_auth();
 
  /* ... */
 
  if ($authenticated)
  {
      include &#39;./sensitive.php&#39;;
  }
 
  ?>

Since sensitive.php is located in the main directory of the website, the browser can skip the verification mechanism and access the file directly. This is because all files in the main directory of the website have a corresponding URL address. In some cases, these scripts may perform an important operation, which increases the risk.

To prevent backdoor URLs, you need to make sure to save all included files outside of your website's home directory. All files saved in the home directory of the website must be directly accessed through URL.

The above is the content of PHP Security-Backdoor URL. For more related content, please pay attention to the PHP Chinese website (www.php.cn)!