Table of Contents
谁能帮忙详细讲解下其中的原理吗?
回复内容:
Home Backend Development PHP Tutorial javascript - %0a(换行符)的执行解析过程

javascript - %0a(换行符)的执行解析过程

Jun 06, 2016 pm 08:40 PM
javascript php Character Encoding Browser

test.php文件的代码如下:

<code>


<!--情况1-->


<script type="text/javascript">
//var a = "<?php echo $_GET['input'];?>";
</script>



<!--情况2-->


<script type="text/javascript">
//var a = "start_%0a_end";
</script>





</code>
Copy after login
Copy after login

情况1:
变量a的值是可控的,由参数input决定,
所以,当从浏览器访问:http://127.0.0.1/test.php?input=start_%0a_end
的时候
查看网页源代码,结果如下:

<code>//省略……
<!--情况1-->


<script type="text/javascript">
//var a = start_
_end;
</script>



<!--情况2-->


<script type="text/javascript">
//var a = "start_%0a_end";
</script>


//省略……
</code>
Copy after login
Copy after login

我们可以发现,情况1中,出现了换行,而情况2保持原样。
为什么会出现这种情况呢?

谁能帮忙详细讲解下其中的原理吗?

说下我对此问题的看法:
当客户端访问网址(http://127.0.0.1/test.php?input=start_%0a_end)的时候,由于是php文件,所以服务端会交个Apache服务器解析执行,并把结果返回给服务端,服务端再将结果通过http响应返回给客户端(浏览器),浏览器再将页面渲染出来,呈现给用户。
用户--->浏览器--->服务器--->apache
那么,
换行到底是:
1.出现在Apache的解析执行的阶段
2.还是浏览器将最终结果呈现给用户这一阶段
如果是出现在Apache的解析执行阶段,那么<?php echo "start_%0a_end";?>应该也会出现换行,但实际上并没有
而如果换行是出现在:浏览器的渲染阶段,那么

<code><br><br><script type="text/javascript">
var a = "start_%0a_end";//注意:此行没有注释
</script>


</code>
Copy after login
Copy after login

应该也会出现换行才是,但实际上也没有

回复内容:

test.php文件的代码如下:

<code>


<!--情况1-->


<script type="text/javascript">
//var a = "<?php echo $_GET['input'];?>";
</script>



<!--情况2-->


<script type="text/javascript">
//var a = "start_%0a_end";
</script>





</code>
Copy after login
Copy after login

情况1:
变量a的值是可控的,由参数input决定,
所以,当从浏览器访问:http://127.0.0.1/test.php?input=start_%0a_end
的时候
查看网页源代码,结果如下:

<code>//省略……
<!--情况1-->


<script type="text/javascript">
//var a = start_
_end;
</script>



<!--情况2-->


<script type="text/javascript">
//var a = "start_%0a_end";
</script>


//省略……
</code>
Copy after login
Copy after login

我们可以发现,情况1中,出现了换行,而情况2保持原样。
为什么会出现这种情况呢?

谁能帮忙详细讲解下其中的原理吗?

说下我对此问题的看法:
当客户端访问网址(http://127.0.0.1/test.php?input=start_%0a_end)的时候,由于是php文件,所以服务端会交个Apache服务器解析执行,并把结果返回给服务端,服务端再将结果通过http响应返回给客户端(浏览器),浏览器再将页面渲染出来,呈现给用户。
用户--->浏览器--->服务器--->apache
那么,
换行到底是:
1.出现在Apache的解析执行的阶段
2.还是浏览器将最终结果呈现给用户这一阶段
如果是出现在Apache的解析执行阶段,那么<?php echo "start_%0a_end";?>应该也会出现换行,但实际上并没有
而如果换行是出现在:浏览器的渲染阶段,那么

<code><br><br><script type="text/javascript">
var a = "start_%0a_end";//注意:此行没有注释
</script>


</code>
Copy after login
Copy after login

应该也会出现换行才是,但实际上也没有

@安坚实 的答案,query string由于地址栏显示、日志记录、或者转义等各方面的需要,必须将部分字符进行翻译(比如无法显示的字符、有特殊含义的控制字符等)

所以你在百度搜索一个&符号的时候 访问到的链接 实际是 http://www.baidu.com/s?wd=%26
因为这个字符与query string中的参数连接符冲突了,需要进行转义

这个过程就是一个编码的过程,这样的编码算法最常见的就是 URLEncodeBase64Encode
而此处使用的是 URLEncode,这个是在 RFC 3986 中定义的

服务端收到了这个请求时,先原样记录在日志中,然后将参数变成应用程序里的字符串 交给web应用处理
这个时候就需要进行一个解码过程,否则得到的数据就与预期不一致了

接上面那个例子,我想搜索的是 字符串& 而不是 字符串%26,因此需要解码变回 &

再解释LZ的例子,浏览器中访问http://127.0.0.1/test.php?input=start_%0a_end时,
其实input这个参数的实际值 并不是 start_%0a_end 这个字符串,只是因为地址栏无法显示换行符,将换行符进行了转义, 他的实际值就是start_[换行]_end,页面输出时,将他还原成了[换行]

如果你想要指定 input参数的实际值为 start_%0a_end, 需要将% 做一次转义,变为 %25

尝试访问一下 http://127.0.0.1/test.php?input=start_%250a_end

解析过程其实是这样的:
用户 --> 浏览器 --> 服务器 --> apache --> PHP解释器

首先,start_%0a_end 被传递给PHP解释器时,%0a 并没有被转换成换行。

<code>var_dump($_SERVER['QUERY_STRING']);   
# string(19) "input=start_%0a_end"
</code>
Copy after login

但是,当它被写入到 $_GET 全局数组里时,就变成换行了

<code>var_dump($_GET['input']); 
#string(11) "start_
#_end"
</code>
Copy after login

因此,应该是PHP解释器在把 query string 的值写入 $_GET 里时,进行了某些处理
至于为什么进行这样的处理,以及如何解决... 这个超出我的知识范围了...

其实这里只涉及到一个知识点,URIEncode,
URI内的字符在传输时会进行转义,当处理程序收到数据时会进行反转义;
%0a 的转义过程大致如下(JS,PHP的过程 @安坚实 已解释了部分):

<code>// encode
encodeURIComponent('\n') // %0A
encodeURIComponent('\n').toLowerCase() === '%0a' // true

// decode
decodeURIComponent('%0a').charCodeAt(0)  // 10
'\n'.charCodeAt(0) // 10
</code>
Copy after login

关于 JS URI 编码部分可见:
http://www.ruanyifeng.com/blog/2010/02/url_encoding.html

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Explain the match expression (PHP 8 ) and how it differs from switch. Explain the match expression (PHP 8 ) and how it differs from switch. Apr 06, 2025 am 12:03 AM

In PHP8, match expressions are a new control structure that returns different results based on the value of the expression. 1) It is similar to a switch statement, but returns a value instead of an execution statement block. 2) The match expression is strictly compared (===), which improves security. 3) It avoids possible break omissions in switch statements and enhances the simplicity and readability of the code.

What is Cross-Site Request Forgery (CSRF) and how do you implement CSRF protection in PHP? What is Cross-Site Request Forgery (CSRF) and how do you implement CSRF protection in PHP? Apr 07, 2025 am 12:02 AM

In PHP, you can effectively prevent CSRF attacks by using unpredictable tokens. Specific methods include: 1. Generate and embed CSRF tokens in the form; 2. Verify the validity of the token when processing the request.

Explain strict types (declare(strict_types=1);) in PHP. Explain strict types (declare(strict_types=1);) in PHP. Apr 07, 2025 am 12:05 AM

Strict types in PHP are enabled by adding declare(strict_types=1); at the top of the file. 1) It forces type checking of function parameters and return values ​​to prevent implicit type conversion. 2) Using strict types can improve the reliability and predictability of the code, reduce bugs, and improve maintainability and readability.

How to correctly display the locally installed 'Jingnan Mai Round Body' on the web page? How to correctly display the locally installed 'Jingnan Mai Round Body' on the web page? Apr 05, 2025 pm 10:33 PM

Using locally installed font files in web pages Recently, I downloaded a free font from the internet and successfully installed it into my system. Now...

How can you prevent a class from being extended or a method from being overridden in PHP? (final keyword) How can you prevent a class from being extended or a method from being overridden in PHP? (final keyword) Apr 08, 2025 am 12:03 AM

In PHP, the final keyword is used to prevent classes from being inherited and methods being overwritten. 1) When marking the class as final, the class cannot be inherited. 2) When marking the method as final, the method cannot be rewritten by the subclass. Using final keywords ensures the stability and security of your code.

What is a composer used for? What is a composer used for? Apr 06, 2025 am 12:02 AM

Composer is a dependency management tool for PHP. The core steps of using Composer include: 1) Declare dependencies in composer.json, such as "stripe/stripe-php":"^7.0"; 2) Run composerinstall to download and configure dependencies; 3) Manage versions and autoloads through composer.lock and autoload.php. Composer simplifies dependency management and improves project efficiency and maintainability.

How to control the top and end of pages in browser printing settings through JavaScript or CSS? How to control the top and end of pages in browser printing settings through JavaScript or CSS? Apr 05, 2025 pm 10:39 PM

How to use JavaScript or CSS to control the top and end of the page in the browser's printing settings. In the browser's printing settings, there is an option to control whether the display is...

How to use locally installed font files on web pages? How to use locally installed font files on web pages? Apr 05, 2025 pm 10:57 PM

How to use locally installed font files on web pages Have you encountered this situation in web page development: you have installed a font on your computer...

See all articles