Security Tips-How to Write Secure PHP Code_PHP Tutorial-PHP Tutorial-php.cn

As a website owner or practitioner, we all hope that our website can be operated safely. However, many times, a small oversight during website development may become a huge security risk for the website. There are many tools and languages for web development nowadays, and PHP is one of them. The PHP language itself has unparalleled security features, but it has not attracted the attention of the majority of website developers. Website security can ensure the security of corporate employees' sensitive data, and can even effectively prevent server hijacking and other issues. The following author will discuss with you some suggestions when using PHP development, hoping to bring some help to users.

First, the most important thing is to clarify the various variables and user input data. Many variables that you are not aware of can themselves become excellent ways for malware programs to spread infections. We can assume that there is some code on your website that is not very secure, but it works fine. After attackers discover these vulnerabilities, they can wreak havoc on your website. Don't underestimate these inconspicuous variable names. Once these vulnerabilities are exploited by hackers, they will not only delete files but also delete the entire password system or other sensitive information, which may ultimately cause huge harm to the normal operation of the server.

Website administrators must check all files imported from the outside for the presence of malicious code , and database security is also crucial. Database security will inevitably involve many SQL injection and other attack methods. I will not elaborate on them here. If users want to know database security information, I will introduce them in detail according to their needs.

　Magic Quotes

Magic Quotes is very useful when processing user file input. When this option is enabled (in your php.ini file) it will separate all single and double quotes, as well as NULL bytes from user input. One question when enabling Magic Quote is whether you want your users to do quote filtering. If you turn off Magic Quote, you can analyze the string of user input data in "runtime".

If you are not familiar with PHP yet, I suggest you enable this feature until you learn how to analyze and present user-entered data. I personally recommend using the "clear" function I wrote. I'll provide you with a template so you can write your own cleanup function.

function clean($string)

{

　　$string = stripslashes($string);

　　$string = htmlentities($string);

　　$string = strip_tags($string);

　　return $string;

　　}

function clean($string)

{

$username = $_POST[username];

　　echo clean($mystring);

　$string = stripslashes($string); 　$string = htmlentities($string); 　$string = strip_tags($string); return $string; 　} 　?> If your user is submitting a form that requires username verification, you can use the following function:

<🎜> $username = $_POST[username]; <🎜> <🎜> echo clean($mystring);<🎜> <🎜>　?>

For this Magic Quote, there are 3 instructions to implement it. You can refer to the php.net website or the php manual. These three instructions are basically magic_quotes_gpc, which are used to handle access requests (get, post, cookies). magic_quotes_runtime is used to process files, databases, and external files. The third type is magic_quotes_sybase. If it is activated, magic_quotes_gpc will be directly destroyed.

　Safety through obscurity

You may not have noticed recently, but I found that you can find ASP (Active Server Page dynamic server homepage) or PERL (a GGI scripting language) extension language in the PHP language on some websites. We can 100% It is certain that this website uses PHP/SQL-based architecture. This is a typical obfuscation security strategy, rather than telling hackers that you are using PHP scripts to mislead them into thinking that you are running PERL or python or any other scripting language.

For example, you can use the php extension to run php scripts, just like normal. In order to prevent others from seeing your "hello.php" script, you are actually using Apache to hide or obfuscate the true file extension. So instead of using the "hello.php" extension, you can disguise these files as PERL and your "hello.php" will still be a PHP script. Like this:

　[quote]AddType application/x-httpd-php .asp .py .pl[/quote]

My favorite is to make up a file extension, such as .sun or .fuck

　[quote]AddType application/x-httpd-php .sun .fuck .1e3t[/quote]

I’m sure when a hacker comes across a file that appears to be running php. Sun files will be eager to launch attacks, and the consequences can be imagined. Just try it and you will know. The above code uses the Apache configuration file. If you are on a shared host, you will not have access to the Apache configuration file.

　Register Globals

PHP changed a lot when the Global4.2 version appeared. This is an on or off option for the INI file in the php.ini file. PHP does not force you to use raw parameters like other languages. Because of this, it is considered an unsafe language. . When register globals is enabled, it allows requests to set parameters. The best example is the user registration form. We assume register globals is turned on:

if($authed = true) {

　　echo "my sensitive information";

　　}

if($authed = true) {

echo "my sensitive information";

$authed = true;

　　if(isset($_POST[authed]) || $_GET[authed]) {

　　echo "variable violation";

　　} else {

　　if($authed == true) {

　　echo "my sensitive information";

　　}

　} 　?> Any user can access sensitive information by sending a GET request. You can log in remotely through telnet (a standard protocol for remote connection services or software that implements this protocol) or a browser, such as sin.php?authed=true, which will display sensitive information. If we turn it off, we will prevent this problem and now when we visit the sin.php?authed=true page, it will be blank. Users cannot initialize variables from external sources. Another way to protect your variables from external sources is to check whether they were sent via a GET or POST request.

<🎜> $authed = true; <🎜> <🎜>　if(isset($_POST[authed]) || $_GET[authed]) {<🎜> <🎜> echo "variable violation";<🎜> <🎜>　} else {<🎜> <🎜>　if($authed == true) {<🎜> <🎜> echo "my sensitive information";<🎜> <🎜>　}<🎜> <🎜>　}<🎜> <🎜>　?>

By monitoring GET or POST requests we can check whether someone has injected something into our variables. The next message we receive not only includes that they have destroyed the variable, but also can notify the administrator in time to take emergency measures.

Related labels：

php code Can how Safety owner Skill of write net website my own

source：php.cn

Previous article：PHP function to obtain remote web content under the same domain name and multiple IPs_PHP tutorial Next article：What to do if a blank page appears on the PHP page_PHP Tutorial

Statement of this Website

The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn