Security Tips-How to Write Secure PHP Code_PHP Tutorial
As a website owner or practitioner, we all hope that our website can be operated safely. However, many times, a small oversight during website development may become a huge security risk for the website. There are many tools and languages for web development nowadays, and PHP is one of them. The PHP language itself has unparalleled security features, but it has not attracted the attention of the majority of website developers. Website security can ensure the security of corporate employees' sensitive data, and can even effectively prevent server hijacking and other issues. The following author will discuss with you some suggestions when using PHP development, hoping to bring some help to users.
First, the most important thing is to clarify the various variables and user input data. Many variables that you are not aware of can themselves become excellent ways for malware programs to spread infections. We can assume that there is some code on your website that is not very secure, but it works fine. After attackers discover these vulnerabilities, they can wreak havoc on your website. Don't underestimate these inconspicuous variable names. Once these vulnerabilities are exploited by hackers, they will not only delete files but also delete the entire password system or other sensitive information, which may ultimately cause huge harm to the normal operation of the server.
Website administrators must check all files imported from the outside for the presence of malicious code , and database security is also crucial. Database security will inevitably involve many SQL injection and other attack methods. I will not elaborate on them here. If users want to know database security information, I will introduce them in detail according to their needs.
Magic Quotes
Magic Quotes is very useful when processing user file input. When this option is enabled (in your php.ini file) it will separate all single and double quotes, as well as NULL bytes from user input. One question when enabling Magic Quote is whether you want your users to do quote filtering. If you turn off Magic Quote, you can analyze the string of user input data in "runtime".
If you are not familiar with PHP yet, I suggest you enable this feature until you learn how to analyze and present user-entered data. I personally recommend using the "clear" function I wrote. I'll provide you with a template so you can write your own cleanup function.
function clean($string) {
For this Magic Quote, there are 3 instructions to implement it. You can refer to the php.net website or the php manual. These three instructions are basically magic_quotes_gpc, which are used to handle access requests (get, post, cookies). magic_quotes_runtime is used to process files, databases, and external files. The third type is magic_quotes_sybase. If it is activated, magic_quotes_gpc will be directly destroyed. Safety through obscurity You may not have noticed recently, but I found that you can find ASP (Active Server Page dynamic server homepage) or PERL (a GGI scripting language) extension language in the PHP language on some websites. We can 100% It is certain that this website uses PHP/SQL-based architecture. This is a typical obfuscation security strategy, rather than telling hackers that you are using PHP scripts to mislead them into thinking that you are running PERL or python or any other scripting language. For example, you can use the php extension to run php scripts, just like normal. In order to prevent others from seeing your "hello.php" script, you are actually using Apache to hide or obfuscate the true file extension. So instead of using the "hello.php" extension, you can disguise these files as PERL and your "hello.php" will still be a PHP script. Like this: [quote]AddType application/x-httpd-php .asp .py .pl[/quote] My favorite is to make up a file extension, such as .sun or .fuck [quote]AddType application/x-httpd-php .sun .fuck .1e3t[/quote] I’m sure when a hacker comes across a file that appears to be running php. Sun files will be eager to launch attacks, and the consequences can be imagined. Just try it and you will know. The above code uses the Apache configuration file. If you are on a shared host, you will not have access to the Apache configuration file. Register Globals PHP changed a lot when the Global4.2 version appeared. This is an on or off option for the INI file in the php.ini file. PHP does not force you to use raw parameters like other languages. Because of this, it is considered an unsafe language. . When register globals is enabled, it allows requests to set parameters. The best example is the user registration form. We assume register globals is turned on:
|
