解读php.ini的基本概念和配置方法
我们在学习1. 用引号界定的字符串(如:”foo”)
2. 一个数字(整数或浮点数,如:0,1,34,-1,33.55)
3. 一个PHP常量(如:E_ALL,M_PI)
4. 一个INI常量(On,Off,none)
5. 一个表达式(如:E_ALL & ~E_NOTICE)
还有另外一个是设置布尔值,1为On就是开启,0为Off就是关闭。php.ini分了很多部分,例如:模块部分,PHP全局配置,数据库配置,等等。了解了基本的概念以后我们就可以开始变态配置之旅。
第一个重要的参数是register_globals. 这个配置影响到PHP如何接收传递过来的参数,说白了register_globals的意思就是注册为全局变量,所以当该参数为值On的时候,传递过来 的值会被直接的注册为全局变量直接使用,而当该参数值为Off的时候,我们需要到从特定的数组里去得到它。从www.milw0rm.com很多的PHP漏洞来看一大部分是因为Register_Globals为On的时候被利用的,所以强烈推荐将这个参数修改成Off,PHP目前的最高版中此参数都是默 认是Off的,没啥说的了,如果你用的版本比较老的话一定要修改这里。
第二个重要的参数是magic_quotes_gpc。如果你把magic_quotes_gpc设置成了Off,那么PHP就不会对4种字符 ‘ (单引号), ” (双引号), (反斜线) 和 空字符进行转义,那这样的话就会造成服务器可能会被非法注入的可能。但是如果你把Magic_quotes_gpc设置成On的话,PHP就会 给$_POST,$_GET,$_COOKIE提交的变量中如果有上面四种字符的话就会加上反斜扛.这样就会大大地提高PHP的安全性。强烈推荐将 Magic_quotes_gpc设置为On。
第三个比较重要的是display_errors。为什么说这个参数重要呢,因为没有不会犯错误的开发者,PHP的 display_errors参数就是帮助开发者定位和确定这些错误的。可是如果PHP提供的这些信息被黑客了解到的话,这就不妙了。比如某国库的网站,因为对display_errors没有进行设置,导致web目录泄露。这对于黑客来说可是非常重要的信息,因为很多时候的渗透都需要知道web 目录,例如webshell的写入等等。所以我们强烈推荐大家把这个参数设置成Off。
第四个重要的参数就是safe_mode,就是我们常说的安全模式。PHP的安全模式是个非常重要的内嵌的安全机制,能够控制一些PHP中的函 数,比如system()等函数,同时把很多文件操作函数进行了权限控制,也不允许对某些关键文件的访问,比如/etc/passwd,但是默认的 php.ini是没有打开安全模式的,我们把它打开。safe_mode = on。
第五个参数是open_basedir,使用open_basedir选项能够控制PHP脚本只能访问指定的目录,这样能够避免PHP脚本访问 不应该访问的文件,一定程度上限制了webshell的危害,我们一般可以设置为只能访问网站目录(假设网站目录为 E:test):open_basedir = E:test 第六个参数是disable_functions,使用disable_functions可以限制一些对于系统来说威胁很大的函数。
例如,我们在第一部分中看到的有PHPinfo()函数的网页中可以看到关于PHP的环境变量等。还有可以利用system,exec等函数来 执行系统命令等等。这里我们推荐过滤的函数如下。disable_functions = PHPinfo,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,
proc_get_status,ini_alter,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,
popepassthru,stream_socket_server。 大家如果对某个函数不了解的话,可以google搜索得到函数的作用,然后来决定您自己的服务器是否禁止掉。
第七个参数是Com组件。Windows平台下的PHP脚本平台存在一个安全漏洞,使得PHP设置即使在安全模式下(safe_mode),仍 旧允许攻击者使用COM()函数来创建系统组件来执行任意命令。漏洞出现的原因是由于在安全模式下的PHP平台虽然system();pathru()函 数被禁止,但是com.allow_dcom的设置依旧是为true。以至于攻击者可以使用COM()函数创建系统组件对象来运行系统命令。
如果是默认的Apache设置或者Web服务器以Loacalsystem权限或Administrators权限运行,攻击者可以使用这个漏 洞来提升权限。所以我们必须要关闭掉com.allow_dcom这个参数默认是True,我们需要吧这个参数修改成 com.allow_dcom=false。第八个参数是expose_PHP。这个参数决定是否暴露 PHP 被安装在服务器上。如果这个参数设置为On的话就会把PHP的版本等泄露出来了。我们的推荐值是Off。
基本上的参数我们就介绍完了,当然php.ini还需要配置,大部分设置跟安全是没有关系的,很大一部分都跟PHP运行的效果(例如优化)等有 关系,如果大家有兴趣的话可以自己参考一下PHP的官方手册来具体了解一下。注意:修改完php.ini以后,必须重新启动IIS,不然你设置的内容不会 即时生效。

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

AI Hentai Generator
Generate AI Hentai for free.

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

Tomato Novel is a very popular novel reading software. We often have new novels and comics to read in Tomato Novel. Every novel and comic is very interesting. Many friends also want to write novels. Earn pocket money and edit the content of the novel you want to write into text. So how do we write the novel in it? My friends don’t know, so let’s go to this site together. Let’s take some time to look at an introduction to how to write a novel. Share the Tomato novel tutorial on how to write a novel. 1. First open the Tomato free novel app on your mobile phone and click on Personal Center - Writer Center. 2. Jump to the Tomato Writer Assistant page - click on Create a new book at the end of the novel.

Unfortunately, people often delete certain contacts accidentally for some reasons. WeChat is a widely used social software. To help users solve this problem, this article will introduce how to retrieve deleted contacts in a simple way. 1. Understand the WeChat contact deletion mechanism. This provides us with the possibility to retrieve deleted contacts. The contact deletion mechanism in WeChat removes them from the address book, but does not delete them completely. 2. Use WeChat’s built-in “Contact Book Recovery” function. WeChat provides “Contact Book Recovery” to save time and energy. Users can quickly retrieve previously deleted contacts through this function. 3. Enter the WeChat settings page and click the lower right corner, open the WeChat application "Me" and click the settings icon in the upper right corner to enter the settings page.

Mobile games have become an integral part of people's lives with the development of technology. It has attracted the attention of many players with its cute dragon egg image and interesting hatching process, and one of the games that has attracted much attention is the mobile version of Dragon Egg. To help players better cultivate and grow their own dragons in the game, this article will introduce to you how to hatch dragon eggs in the mobile version. 1. Choose the appropriate type of dragon egg. Players need to carefully choose the type of dragon egg that they like and suit themselves, based on the different types of dragon egg attributes and abilities provided in the game. 2. Upgrade the level of the incubation machine. Players need to improve the level of the incubation machine by completing tasks and collecting props. The level of the incubation machine determines the hatching speed and hatching success rate. 3. Collect the resources required for hatching. Players need to be in the game

Setting font size has become an important personalization requirement as mobile phones become an important tool in people's daily lives. In order to meet the needs of different users, this article will introduce how to improve the mobile phone use experience and adjust the font size of the mobile phone through simple operations. Why do you need to adjust the font size of your mobile phone - Adjusting the font size can make the text clearer and easier to read - Suitable for the reading needs of users of different ages - Convenient for users with poor vision to use the font size setting function of the mobile phone system - How to enter the system settings interface - In Find and enter the "Display" option in the settings interface - find the "Font Size" option and adjust it. Adjust the font size with a third-party application - download and install an application that supports font size adjustment - open the application and enter the relevant settings interface - according to the individual

The difference between Go language methods and functions lies in their association with structures: methods are associated with structures and are used to operate structure data or methods; functions are independent of types and are used to perform general operations.

Mobile phone film has become one of the indispensable accessories with the popularity of smartphones. To extend its service life, choose a suitable mobile phone film to protect the mobile phone screen. To help readers choose the most suitable mobile phone film for themselves, this article will introduce several key points and techniques for purchasing mobile phone film. Understand the materials and types of mobile phone films: PET film, TPU, etc. Mobile phone films are made of a variety of materials, including tempered glass. PET film is relatively soft, tempered glass film has good scratch resistance, and TPU has good shock-proof performance. It can be decided based on personal preference and needs when choosing. Consider the degree of screen protection. Different types of mobile phone films have different degrees of screen protection. PET film mainly plays an anti-scratch role, while tempered glass film has better drop resistance. You can choose to have better

1. First open pycharm and enter the pycharm homepage. 2. Then create a new python script, right-click - click new - click pythonfile. 3. Enter a string, code: s="-". 4. Then you need to repeat the symbols in the string 20 times, code: s1=s*20. 5. Enter the print output code, code: print(s1). 6. Finally run the script and you will see our return value at the bottom: - repeated 20 times.

In 2025, global digital virtual currency trading platforms are fiercely competitive. This article authoritatively releases the top ten digital virtual currency trading platforms in the world in 2025 based on indicators such as transaction volume, security, and user experience. OKX ranks first with its strong technical strength and global operation strategy, and Binance follows closely with high liquidity and low fees. Platforms such as Gate.io, Coinbase, and Kraken are at the forefront with their respective advantages. The list covers trading platforms such as Huobi, KuCoin, Bitfinex, Crypto.com and Gemini, each with its own characteristics, but investment should be cautious. To choose a platform, you need to consider factors such as security, liquidity, fees, user experience, currency selection and regulatory compliance, and invest rationally
