javascript - %0a(换行符)的执行解析过程
test.php
文件的代码如下:
<code> <!--情况1--> <script type="text/javascript"> //var a = "<?php echo $_GET['input'];?>"; </script> <!--情况2--> <script type="text/javascript"> //var a = "start_%0a_end"; </script> </code>
情况1:
变量a的值是可控的,由参数input决定,
所以,当从浏览器访问:http://127.0.0.1/test.php?input=start_%0a_end
的时候
查看网页源代码,结果如下:
<code>//省略…… <!--情况1--> <script type="text/javascript"> //var a = start_ _end; </script> <!--情况2--> <script type="text/javascript"> //var a = "start_%0a_end"; </script> //省略…… </code>
我们可以发现,情况1中,出现了换行,而情况2保持原样。
为什么会出现这种情况呢?
谁能帮忙详细讲解下其中的原理吗?
说下我对此问题的看法:
当客户端访问网址(http://127.0.0.1/test.php?input=start_%0a_end)的时候,由于是php文件,所以服务端会交个Apache服务器解析执行,并把结果返回给服务端,服务端再将结果通过http响应返回给客户端(浏览器),浏览器再将页面渲染出来,呈现给用户。
用户--->浏览器--->服务器--->apache
那么,
换行到底是:
1.出现在Apache的解析执行的阶段
2.还是浏览器将最终结果呈现给用户这一阶段
如果是出现在Apache的解析执行阶段,那么<?php echo "start_%0a_end";?>
应该也会出现换行,但实际上并没有
而如果换行是出现在:浏览器的渲染阶段,那么
<code><br><br><script type="text/javascript"> var a = "start_%0a_end";//注意:此行没有注释 </script> </code>
应该也会出现换行才是,但实际上也没有
回复内容:
test.php
文件的代码如下:
<code> <!--情况1--> <script type="text/javascript"> //var a = "<?php echo $_GET['input'];?>"; </script> <!--情况2--> <script type="text/javascript"> //var a = "start_%0a_end"; </script> </code>
情况1:
变量a的值是可控的,由参数input决定,
所以,当从浏览器访问:http://127.0.0.1/test.php?input=start_%0a_end
的时候
查看网页源代码,结果如下:
<code>//省略…… <!--情况1--> <script type="text/javascript"> //var a = start_ _end; </script> <!--情况2--> <script type="text/javascript"> //var a = "start_%0a_end"; </script> //省略…… </code>
我们可以发现,情况1中,出现了换行,而情况2保持原样。
为什么会出现这种情况呢?
谁能帮忙详细讲解下其中的原理吗?
说下我对此问题的看法:
当客户端访问网址(http://127.0.0.1/test.php?input=start_%0a_end)的时候,由于是php文件,所以服务端会交个Apache服务器解析执行,并把结果返回给服务端,服务端再将结果通过http响应返回给客户端(浏览器),浏览器再将页面渲染出来,呈现给用户。
用户--->浏览器--->服务器--->apache
那么,
换行到底是:
1.出现在Apache的解析执行的阶段
2.还是浏览器将最终结果呈现给用户这一阶段
如果是出现在Apache的解析执行阶段,那么<?php echo "start_%0a_end";?>
应该也会出现换行,但实际上并没有
而如果换行是出现在:浏览器的渲染阶段,那么
<code><br><br><script type="text/javascript"> var a = "start_%0a_end";//注意:此行没有注释 </script> </code>
应该也会出现换行才是,但实际上也没有
接 @安坚实
的答案,query string
由于地址栏显示、日志记录、或者转义等各方面的需要,必须将部分字符进行翻译(比如无法显示的字符、有特殊含义的控制字符等)
所以你在百度搜索一个
&
符号的时候 访问到的链接 实际是http://www.baidu.com/s?wd=%26
因为这个字符与query string中的参数连接符
冲突了,需要进行转义
这个过程就是一个编码的过程,这样的编码算法最常见的就是 URLEncode
和 Base64Encode
而此处使用的是 URLEncode
,这个是在 RFC 3986 中定义的
服务端收到了这个请求时,先原样记录在日志中,然后将参数变成应用程序里的字符串 交给web应用处理
这个时候就需要进行一个解码过程,否则得到的数据就与预期不一致了
接上面那个例子,我想搜索的是 字符串
&
而不是 字符串%26
,因此需要解码变回&
再解释LZ的例子,浏览器中访问http://127.0.0.1/test.php?input=start_%0a_end
时,
其实input这个参数的实际值 并不是 start_%0a_end
这个字符串,只是因为地址栏无法显示换行符,将换行符进行了转义, 他的实际值就是start_[换行]_end
,页面输出时,将他还原成了[换行]
如果你想要指定 input参数的实际值为 start_%0a_end
, 需要将%
做一次转义,变为 %25
尝试访问一下 http://127.0.0.1/test.php?input=start_%250a_end
解析过程其实是这样的:
用户 --> 浏览器 --> 服务器 --> apache --> PHP解释器
首先,start_%0a_end
被传递给PHP解释器时,%0a 并没有被转换成换行。
<code>var_dump($_SERVER['QUERY_STRING']); # string(19) "input=start_%0a_end" </code>
但是,当它被写入到 $_GET 全局数组里时,就变成换行了
<code>var_dump($_GET['input']); #string(11) "start_ #_end" </code>
因此,应该是PHP解释器在把 query string 的值写入 $_GET 里时,进行了某些处理
至于为什么进行这样的处理,以及如何解决... 这个超出我的知识范围了...
其实这里只涉及到一个知识点,URIEncode,
URI内的字符在传输时会进行转义,当处理程序收到数据时会进行反转义;%0a
的转义过程大致如下(JS,PHP的过程 @安坚实 已解释了部分):
<code>// encode encodeURIComponent('\n') // %0A encodeURIComponent('\n').toLowerCase() === '%0a' // true // decode decodeURIComponent('%0a').charCodeAt(0) // 10 '\n'.charCodeAt(0) // 10 </code>
关于 JS URI 编码部分可见:
http://www.ruanyifeng.com/blog/2010/02/url_encoding.html

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

AI Hentai Generator
Generate AI Hentai for free.

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

Coinbase Security Login Guide: How to Avoid Phishing Sites and Scams? Phishing and scams are becoming increasingly rampant, and it is crucial to securely access the Coinbase official login portal. This article provides practical guides to help users securely find and use the latest official login portal of Coinbase to protect the security of digital assets. We will cover how to identify phishing sites, and how to log in securely through official websites, mobile apps or trusted third-party platforms, and provide suggestions for enhancing account security, such as using a strong password and enabling two-factor verification. To avoid asset losses due to incorrect login, be sure to read this article carefully!

As the world's leading digital asset trading platform, Ouyi OKX attracts many investors with its rich trading products, strong security guarantees and convenient user experience. However, the risks of network security are becoming increasingly severe, and how to safely register the official Ouyi OKX account is crucial. This article will provide the latest registration portal for Ouyi OKX official website, and explain in detail the steps and precautions for safe registration, including how to identify the official website, set a strong password, enable two-factor verification, etc., to help you start your digital asset investment journey safely and conveniently. Please note that there are risks in digital asset investment, please make cautious decisions.

This article provides a detailed guide to safe download of Ouyi OKX App in China. Due to restrictions on domestic app stores, users are advised to download the App through the official website of Ouyi OKX, or use the QR code provided by the official website to scan and download. During the download process, be sure to verify the official website address, check the application permissions, perform a security scan after installation, and enable two-factor verification. During use, please abide by local laws and regulations, use a safe network environment, protect account security, be vigilant against fraud, and invest rationally. This article is for reference only and does not constitute investment advice. Digital asset transactions are at your own risk.

This article provides safe and reliable guides to help users access the latest official website of BitMEX exchange and improve transaction security. Due to regulatory and cybersecurity threats, it is crucial to identify the official BitMEX website and avoid phishing websites stealing account information and funds. The article introduces the search for official website portals through trusted cryptocurrency platforms, official social media, news media, and subscribes to official emails. It emphasizes the importance of checking domain names, using HTTPS connections, checking security certificates, and enabling two-factor verification and changing passwords regularly. Remember, cryptocurrency trading is high risk, please invest with caution.

LOOM Coin, a once-highly-known blockchain game and social application development platform token, its ICO was held on April 25, 2018, with an issue price of approximately US$0.076 per coin. This article will conduct in-depth discussion on the issuance time, price and important precautions of LOOM coins, including market volatility risks and project development prospects. Investors should be cautious and do not follow the trend blindly. It is recommended to refer to the official website of Loom Network, blockchain browser and cryptocurrency information platform to obtain the latest information and conduct sufficient risk assessment. The information in this article is for reference only and does not constitute investment advice. Learn about LOOM coins, start here!

This article provides a safe and reliable Binance Exchange App download guide to help users solve the problem of downloading Binance App in the country. Due to restrictions on domestic application stores, the article recommends priority to downloading APK installation packages from Binance official website, and introduces three methods: official website download, third-party application store download, and friends sharing. At the same time, it emphasizes security precautions during the download process, such as verifying the official website address, checking application permissions, scanning with security software, etc. In addition, the article also reminds users to understand local laws and regulations, pay attention to network security, protect personal information, beware of fraud, rational investment, and secure transactions. At the end of the article, the article once again emphasized that downloading and using Binance App must comply with local laws and regulations, and at your own risk, and does not constitute any investment advice.

The Coinbase exchange web version is popular for its convenience, but secure access is crucial. This article aims to guide users to log in to the official Coinbase web version safely and avoid phishing websites and hackers. We will explain in detail how to verify the official portal through search engines, trusted third-party platforms and official social media, and emphasize security measures such as checking the address bar security lock, enabling two-factor verification, avoiding public Wi-Fi, changing passwords regularly, and being alert to phishing emails to ensure the security of your digital assets. Correct access to the official Coinbase website is the first step to protecting your digital currency. This article will help you start your digital currency trading journey safely.

As a veteran cryptocurrency derivatives trading platform, the accuracy of its official website entrance is crucial. Due to rampant phishing websites, misent entry into fake websites can lead to account theft and loss of funds. This article aims to guide users to safely access the BitMEX official website, provide various methods such as trusted cryptocurrency information platforms (such as CoinMarketCap, CoinGecko), official social media, verification of existing addresses and official support channels, and emphasizes the use of security measures such as two-factor verification, regular password changes and use of security software to help users effectively avoid risks and ensure account security.
