PHP security (1)

xiaoxiao2021-03-06  52

PHP Safety (1) PHP Safety (1) Original: John Coggeshall 07/31/2003 Original: http://www.onlamp.com/pub/a/php/2003/07/31/php_foundations.html in the nearest two Column ("Common Style Error (on)" and "Common Style Error (below)") I discussed some common makers to read and easily lead to the bad habits of BUG when writing a PHP program. In today's article, I will turn to discuss the focus of this series: when using PHP, the importance of security issues. The importance of paying attention to security issues Seeing the far-off prevention of users from maliciously destroying your program is the most effective way to neglect it is to consider its possibilities when writing code. It is important to pay attention to the possible security issues in your code. Consider the following example function to simplify the process of writing a large number of text files in PHP: This function comes with two default parameters, file names, and text to write to files. The function will check if the file has been opened; if so, the original file handle will be used. Otherwise, you will be created yourself. In both cases, the text will be written to the file. If the file name passed to the function is null, all open files will be turned off. The following is provided with an example. If the developer is written in the format below to write multiple text files, then this function will be clear and easy to read. Let us assume that this function exists in a separate file, this file contains code that calls this function.

Next is a program, we call it quotes.php:

choose the Nature of the quote :

quote saved! ";} else {echo "< Center>

Error Writing quote ";} Write_text (null);" As you can see, this developer uses the Write_text () function to create a system make Users can submit their favorite motto, which will be stored in a text file. Unfortunately, developers may have not thought that this program also allows malicious users to harm the security of Web Server. Maybe now you are thinking about how this seems that this seems and innocent program introduces security risks. If you can't see it, consider this URL, remember this program called quotes.php: http://www.somewhere.com/fun/quotes.php?quote=different_file.dat"e_text=garbage data When this URL What will happen when passing to web server? Obviously, quotes.php will be executed, but it is not written to one of the three files we hope. The reverse, a new file called Different_File.dat will It is created, which contains a string Garbage Data.

转载请注明原文地址:https://www.9cbs.com/read-115849.html

New Post(0)