Use the == comparison operator with caution, because PHP is untyped, but the underlying C implementation engine is typed. In the end, there is type conversion. For example, the result of 0=="abc" is true, which may not be what we want.
Semantically speaking, where there is a clear type, we must use the relevant function to explicitly convert it: intval . . .
Unify the PHP file inclusion path in one place, so that when including files in various places in the project, do not bring the path, just the file name, which facilitates the transfer of files
There are still other problems with PHP applications One is not to use PHP global variables directly in functions or class methods, but to provide a separate proxy for accessing global variables, which can be an object or just a simple function. If you access global variables in a class, modify To use objects that proxy global variables so that there is a clear dependency between the two objects, do not use global variables directly inside the function or variables outside global. A function should only use the data passed in as function parameters. Try not to use global variables and go global everywhere, and be careful about repeated submissions of forms. This can take the form of a token.
Determine whether the system is single entry or multiple entry
Pay attention to the encoding: file storage encoding, page encoding, database encoding, user's operating system encoding (when the user directly enters content on the address, FF, Opera The content will be encoded according to the encoding urlencode of the operating system, and IE6 is as it is)
Do not expose the path of the file
After submitting the request, the user closes the browser or clicks the stop button of the browser or other network reasons After disconnection, whether PHP should continue processing or stop processing, how does PHP know the above situation: connection-handling(ignore_user_abort,register_shutdown_function,connection_status...)
Time zone issue, if the application is distributed
explode applied to a null value will produce an array containing 1 item: array(""), but the latter is not false. That is: null is a false value, but after explode(',',null) it is a true value, so be careful with conditions like if(explode(',',$var))
$var = null ;isset($var) results in false.
Security issues of PHP application
Verify input, do not trust the data from the user (GET, POST, COOKIE). For a PHP application, these data should be filtered uniformly. For example, encoding html tags prevents XSS and prevents SQL injection.
At the same time, PHP needs to verify the content that needs to be verified once, because various verifications on the client can be easily skipped (pseudo forms, disabling tools such as js and firebug that can modify html at will).
Be aware of the size of the data submitted by the user. For example, if the post data or get data is too large, buffer overflow may occur
Be careful with non-PHP files on the server. If the application can upload or download files, avoid reading the file directly through the file name and the file name is provided by the user. The user may provide some files that he should not see, but the PHP program reads them. At the same time, do not display the file path in the returned HTML. The file saving path should not be visible to the user. The user may guess other files that they should not see based on these paths
If the session is saved in a file , and there are other unknown users on the web server (such as rented web hosts), you should modify the storage location of the session file, or write the session to the database through the PHP session handler, because the session is saved in the temporary directory by default , others can access it, which is dangerous if information such as passwords are saved in the session.
The above are the relevant solutions to PHP application problems.
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
