We only talk about the Linux system as an example, but the prevention method is effective in any system. Let’s take a look at the following operations.
You can use it like this
The code is as follows
| 代码如下 |
复制代码 |
|
http://www.xxx.com/index.php?page=../etc/passwd
http://www.xxx.com/index.php?page=../../../etc/passwd
http://www.xxx.com/index.php?page=..../../etc/passwd
获取更多数据:
etc/profile
etc/services
/etc/passwd
/etc/shadow
/etc/group
/etc/security/group
/etc/security/passwd
/etc/security/user
/etc/security/environ
/etc/security/limits
/usr/lib/security/mkuser.default
|
|
Copy code
|
|
http://www.xxx.com/index.php?page=../etc/passwd
http://www.xxx.com/index.php?page=../../../etc/passwd
http://www.xxx.com/index.php?page=..../../etc/passwd
| 代码如下 |
复制代码 |
|
?page=intval($_GET);
|
Get more data:
etc/profile
etc/services
/etc/passwd
/etc/shadow
/etc/group
| 代码如下 |
复制代码 |
|
$body = htmlspecialchars(isset($_GET[$str])?$_GET[$str]:'');
|
/etc/security/group
/etc/security/passwd
/etc/security/user |
/etc/security/environ
/etc/security/limits
/usr/lib/security/mkuser.default
Like the above code, if you are
?page=$_GET This is it. Analyze the reason, because we only have numbers for paging, so we do it like this
| The code is as follows
|
Copy code
?page=intval($_GET);
In this way, the characters cannot be submitted. We use the intval function to filter, so how to deal with the submitted characters. When processing characters, we use PHP’s built-in functions addslashes and htmlspecialchars to filter,
as
| The code is as follows
|
Copy code
|
|
$body = htmlspecialchars(isset($_GET[$str])?$_GET[$str]:'');
This basically filters out various security injections. Of course, if your server has vulnerabilities, it cannot be solved in PHP.
http://www.bkjia.com/PHPjc/629691.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/629691.htmlTechArticleWe only talk about Linux systems as examples, but the prevention methods are effective in any system. Let’s look at them first. To see the operation, you can use the code as follows Copy the code http://www.xx...
|
|
|
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
