PHP security-source code exposure (2)
## Source code exposed
Your WEB server must be able to read your source code and execute it. This means that when the code written by anyone is run by the server, it can also read your source code. On a shared hosting, the biggest risk is that because the WEB server is shared, PHP code written by other developers can read arbitrary files.
<?php header('Content-Type: text/plain'); readfile($_GET['file']); ?>
## By running the above script on the host where your source code resides, an attacker can cause the WEB server to read and display any file by specifying the file value as a full path and file name. For example, assuming that the script is named file.php and is located on the host example.org, the contents of the file /path/to/source.php can be exposed by accessing the following link:
http://www.php.cn/
Of course, for this simple code to work, an attacker would have to know exactly where your source code is, but an attacker could write a more complex script that would allow them to browse the entire file system. For such scripts, see the examples later in this chapter.
There is no perfect solution to this problem. As discussed in Chapter 5, you must consider that all of your source code is public, even code that is stored outside of your home WEB directory.
The best approach is to keep all sensitive data in a database. While this adds an extra layer of complexity to writing some code, it's the best way to prevent your sensitive data from being exposed. Unfortunately, there is another problem. How to save your database access password?
Please look at a file named db.inc saved outside the main directory of the website:
<?php
$db_user = 'myuser';
$db_pass = 'mypass';
$db_host = 'localhost';
$db = mysql_connect($db_host, $db_user,
$db_pass);
?>
If the path to the file is known (or guessed), there is a possibility that another user on your server accesses the file and will gain database access, so that all the data you save in the database will be will be exposed.
The best solution to this problem is to save your database access permissions in a file that can only be read by system administrators in the following format:
SetEnv DB_USER "myuser"
SetEnv DB_PASS "mypass"
## SetEnv is an Apache command. The above file means to create two Apache environment variables that represent your database username and password respectively. Of course, the key to this trick is that only system administrators can read the file. If you can't log in as a system administrator, you can restrict the file to being readable only by yourself, which is a similar protection method as above.
$ chmod 600 db.conf $ ls db.conf -rw------- 1 chris chris 48 May 21 12:34 db.conf
## This effectively prevents malicious scripts from gaining access to your data, so there is no significant risk to the security of sensitive data held in the database.
For this file to work, you need to be able to access the data in it through PHP. To achieve this goal, you need to write the following inclusion sentence in httpd.conf:
Include "/path/to/db.conf"
It should be noted that this statement needs to be inserted in the VirtualHost area, otherwise other users can obtain the corresponding content.
Since the parent process of Apache runs as a system administrator (needs to bind to port 80), it is able to read the configuration file, but the child process that handles server requests (running PHP scripts) cannot read the file.
You can access these two variables through the $_SERVER super global array, so in db.inc, you only need to reference the $_SERVER variable instead of stating the database permissions:
<?php $db_user = $_SERVER['DB_USER']; $db_pass = $_SERVER['DB_PASS']; $db_host = 'localhost'; $db = mysql_connect($db_host, $db_user, $db_pass); ?>
If the file is exposed, database access will not be compromised. This is a major security improvement for shared hosting, and it is also an in-depth defense method for independent hosting.
Note that when using the above technique, database access rights are located in the $_SERVER super public array. This requires also restricting ordinary visitors from running phpinfo() to view or any other reasons that cause the contents of $_SERVER to be exposed.
Of course, you can use this technique to protect any information (not just database access), but I find it more convenient to save most data in a database, especially since this technique requires assistance from your hosting provider.
The above is the content of PHP Security-Source Code Exposure (2). For more related content, please pay attention to the PHP Chinese website (www.php.cn)!
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
1664
14
1423
52
1317
25
1268
29
1246
24
Explain JSON Web Tokens (JWT) and their use case in PHP APIs.
Apr 05, 2025 am 12:04 AM
JWT is an open standard based on JSON, used to securely transmit information between parties, mainly for identity authentication and information exchange. 1. JWT consists of three parts: Header, Payload and Signature. 2. The working principle of JWT includes three steps: generating JWT, verifying JWT and parsing Payload. 3. When using JWT for authentication in PHP, JWT can be generated and verified, and user role and permission information can be included in advanced usage. 4. Common errors include signature verification failure, token expiration, and payload oversized. Debugging skills include using debugging tools and logging. 5. Performance optimization and best practices include using appropriate signature algorithms, setting validity periods reasonably,
Explain late static binding in PHP (static::).
Apr 03, 2025 am 12:04 AM
Static binding (static::) implements late static binding (LSB) in PHP, allowing calling classes to be referenced in static contexts rather than defining classes. 1) The parsing process is performed at runtime, 2) Look up the call class in the inheritance relationship, 3) It may bring performance overhead.
What are PHP magic methods (__construct, __destruct, __call, __get, __set, etc.) and provide use cases?
Apr 03, 2025 am 12:03 AM
What are the magic methods of PHP? PHP's magic methods include: 1.\_\_construct, used to initialize objects; 2.\_\_destruct, used to clean up resources; 3.\_\_call, handle non-existent method calls; 4.\_\_get, implement dynamic attribute access; 5.\_\_set, implement dynamic attribute settings. These methods are automatically called in certain situations, improving code flexibility and efficiency.
PHP and Python: Comparing Two Popular Programming Languages
Apr 14, 2025 am 12:13 AM
PHP and Python each have their own advantages, and choose according to project requirements. 1.PHP is suitable for web development, especially for rapid development and maintenance of websites. 2. Python is suitable for data science, machine learning and artificial intelligence, with concise syntax and suitable for beginners.
PHP in Action: Real-World Examples and Applications
Apr 14, 2025 am 12:19 AM
PHP is widely used in e-commerce, content management systems and API development. 1) E-commerce: used for shopping cart function and payment processing. 2) Content management system: used for dynamic content generation and user management. 3) API development: used for RESTful API development and API security. Through performance optimization and best practices, the efficiency and maintainability of PHP applications are improved.
PHP: A Key Language for Web Development
Apr 13, 2025 am 12:08 AM
PHP is a scripting language widely used on the server side, especially suitable for web development. 1.PHP can embed HTML, process HTTP requests and responses, and supports a variety of databases. 2.PHP is used to generate dynamic web content, process form data, access databases, etc., with strong community support and open source resources. 3. PHP is an interpreted language, and the execution process includes lexical analysis, grammatical analysis, compilation and execution. 4.PHP can be combined with MySQL for advanced applications such as user registration systems. 5. When debugging PHP, you can use functions such as error_reporting() and var_dump(). 6. Optimize PHP code to use caching mechanisms, optimize database queries and use built-in functions. 7
The Enduring Relevance of PHP: Is It Still Alive?
Apr 14, 2025 am 12:12 AM
PHP is still dynamic and still occupies an important position in the field of modern programming. 1) PHP's simplicity and powerful community support make it widely used in web development; 2) Its flexibility and stability make it outstanding in handling web forms, database operations and file processing; 3) PHP is constantly evolving and optimizing, suitable for beginners and experienced developers.
Explain the match expression (PHP 8 ) and how it differs from switch.
Apr 06, 2025 am 12:03 AM
In PHP8, match expressions are a new control structure that returns different results based on the value of the expression. 1) It is similar to a switch statement, but returns a value instead of an execution statement block. 2) The match expression is strictly compared (===), which improves security. 3) It avoids possible break omissions in switch statements and enhances the simplicity and readability of the code.
