php 安全有關(guān)問題
Jun 13, 2016 am 10:49 AM
php 安全問題
做web開發(fā),相信搭建都知道一些安全基本知識,”千萬不能相信客戶端數(shù)據(jù)“。而php又是一種弱類型語言。很多人在開發(fā)過程中忽略了類型轉(zhuǎn)換,參數(shù)過濾直接量成不可估量的后果。
不使用過濾函數(shù)可能出現(xiàn)以下情況:
數(shù)據(jù)庫被(sql)注入。直接可以導致你的系統(tǒng)崩潰,系統(tǒng)數(shù)據(jù)丟失,用戶信息丟失。網(wǎng)站被掛馬,遇到文件處理則可以將你的網(wǎng)站文件刪除。
另外值得一提的是很多人認為開啟php安全模式就萬事大吉了。其實不然,很多注入者往往繞過正面,進行側(cè)面進攻。
使用?0×7e,0×27等(ASCII碼)字符串來充當引號,而php又無法過濾。注入的一般方式都是在參數(shù)里面加入很多mysql?sql語法,去獲取敏感數(shù)據(jù)信息。
exp:
and(select1from(select?count(*),concat((select(select(select?concat(0x7e,0x27,phpcms_member.username,0x27,0x7e)from?phpcms_member?limit0,1))from?information_schema.tableslimit0,1),floor(rand(0)*2))x?from?information_schema.tablesgroupby?x)a)and1=1 |
mysql information_schema.tables 所有用戶都可見可查,能查出所有表結(jié)構(gòu)信息,數(shù)據(jù)庫信息。
php開源系統(tǒng)很多,很多開源系統(tǒng)大家知道數(shù)據(jù)結(jié)構(gòu),已級敏感信息表。(這里當然也包括不法分子)
這里指的敏感信息:往往是一些用戶信息,管理端信息。現(xiàn)在md5的窮舉一直在進行著。很多的md5加密之后的密碼仍然能被解密成明文。
很多系統(tǒng)都做了相應的安全提升。
下面介紹以下常見手段:
使用過濾函數(shù),php filter 安全過濾函數(shù).md5( ?md5(‘用戶密碼’) . ‘私鑰’ ) 得出加密結(jié)果。常用的php開源系統(tǒng)后臺一定要修改目錄名。很多系統(tǒng)后臺直接使用admin作為后臺入口。不要將phpmyadmin等數(shù)據(jù)庫操作軟件安置在網(wǎng)站可見目錄。
等等。。之所以這樣是由于現(xiàn)在大量存在掃描工具去掃描這樣的管理端。
下面是驚心的一張圖
?
mysql 注入
?
mysql 注入
出處:?馬丁博客[http://www.blags.org/]
本文鏈接地址:?http://www.blags.org/php-security-issue/
?

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

std::chrono is used in C to process time, including obtaining the current time, measuring execution time, operation time point and duration, and formatting analysis time. 1. Use std::chrono::system_clock::now() to obtain the current time, which can be converted into a readable string, but the system clock may not be monotonous; 2. Use std::chrono::steady_clock to measure the execution time to ensure monotony, and convert it into milliseconds, seconds and other units through duration_cast; 3. Time point (time_point) and duration (duration) can be interoperable, but attention should be paid to unit compatibility and clock epoch (epoch)

ToaccessenvironmentvariablesinPHP,usegetenv()orthe$_ENVsuperglobal.1.getenv('VAR_NAME')retrievesaspecificvariable.2.$_ENV['VAR_NAME']accessesvariablesifvariables_orderinphp.iniincludes"E".SetvariablesviaCLIwithVAR=valuephpscript.php,inApach

The purpose of select plus default is to allow select to perform default behavior when no other branches are ready to avoid program blocking. 1. When receiving data from the channel without blocking, if the channel is empty, it will directly enter the default branch; 2. In combination with time. After or ticker, try to send data regularly. If the channel is full, it will not block and skip; 3. Prevent deadlocks, avoid program stuck when uncertain whether the channel is closed; when using it, please note that the default branch will be executed immediately and cannot be abused, and default and case are mutually exclusive and will not be executed at the same time.

PHPhasthreecommentstyles://,#forsingle-lineand/.../formulti-line.Usecommentstoexplainwhycodeexists,notwhatitdoes.MarkTODO/FIXMEitemsanddisablecodetemporarilyduringdebugging.Avoidover-commentingsimplelogic.Writeconcise,grammaticallycorrectcommentsandu

CTE is a temporary result set in MySQL used to simplify complex queries. It can be referenced multiple times in the current query, improving code readability and maintenance. For example, when looking for the latest orders for each user in the orders table, you can first obtain the latest order date for each user through the CTE, and then associate it with the original table to obtain the complete record. Compared with subqueries, the CTE structure is clearer and the logic is easier to debug. Usage tips include explicit alias, concatenating multiple CTEs, and processing tree data with recursive CTEs. Mastering CTE can make SQL more elegant and efficient.

In PHP, you can use a variety of methods to determine whether a string starts with a specific string: 1. Use strncmp() to compare the first n characters. If 0 is returned, the beginning matches and is not case sensitive; 2. Use strpos() to check whether the substring position is 0, which is case sensitive. Stripos() can be used instead to achieve case insensitive; 3. You can encapsulate the startsWith() or str_starts_with() function to improve reusability; in addition, it is necessary to note that empty strings return true by default, encoding compatibility and performance differences, strncmp() is usually more efficient.

WhensettingupMySQLtables,choosingtherightdatatypesiscrucialforefficiencyandscalability.1)Understandthedataeachcolumnwillstore—numbers,text,dates,orflags—andchooseaccordingly.2)UseCHARforfixed-lengthdatalikecountrycodesandVARCHARforvariable-lengthdata

There are three key ways to avoid the "undefinedindex" error: First, use isset() to check whether the array key exists and ensure that the value is not null, which is suitable for most common scenarios; second, use array_key_exists() to only determine whether the key exists, which is suitable for situations where the key does not exist and the value is null; finally, use the empty merge operator?? (PHP7) to concisely set the default value, which is recommended for modern PHP projects, and pay attention to the spelling of form field names, use extract() carefully, and check the array is not empty before traversing to further avoid risks.
