文章分类 - php安全编程
摘要：PHP Security Guide: SessionsDatabases and SQLShared HostsSession FixationSession security is a sophisticated topic, and it's no surprise that sessions are a frequent target of attack. Most session attacks involve impersonation, where the attacker attempts to gain access to another user's ses
阅读全文
摘要：Password Hashingby James McGlinnIn this article I'm going to cover password hashing, a subject which is often poorly understood by newer developers. Recently I've been asked to look at several web applications which all had the same security issue - user profiles stored in a database with pl
阅读全文
摘要：PHP Security Guide: OverviewTable of ContentsForm ProcessingWhat Is Security?Security is a measurement, not a characteristic.It is unfortunate that many software projects list security as a simple requirement to be met. Is it secure? This question is as subjective as asking if something is hot.Secur
阅读全文
摘要：PHP Security Guide: Shared HostsSessionsAboutExposed Session DataWhen on a shared host, security simply isn't going to be as strong as when on a dedicated host. This is one of the tradeoffs for the inexpensive fee.One particularly vulnerable aspect of shared hosting is having a shared session st
阅读全文
摘要：PHP Security Guide: Databases and SQLForm ProcessingSessionsExposed Access CredentialsMost PHP applications interact with a database. This usually involves connecting to a database server and using access credentials to authenticate:This could be an example of a file calleddb.incthat is included whe
阅读全文
摘要：Using PEAR'sText_CAPTCHAto Secure Web Formsby Marcus WhitneyWhen you have public forms on the web, you are always prone to attacks by those who want to use your application for their own purposes. Forums, polls, guestbooks, and blogs are some of the popular places where automated robots can be f
阅读全文
摘要：PHP Security Guide: Form ProcessingOverviewDatabases and SQLSpoofed Form SubmissionsIn order to appreciate the necessity of data filtering, consider the following form located (hypothetically speaking) athttp://example.org/form.html:Imagine a potential attacker who saves this HTML and modifies it as
阅读全文
摘要：cleartext = '1234567890123456';$crypt->generate_iv();$crypt->encrypt();$ciphertext = $crypt->ciphertext;$iv = $crypt->iv;$string = base64_encode($iv . $ciphertext);?>Store this string in the database. Upon retrieval, reverse this process as follows:iv = $iv;$crypt->cipherte
阅读全文
摘要：1.eval()The eval( )function is used for evaluating a string as PHP. For example:2. exec( )Try to avoid using shell command functions, but when you require them, be sure to use only filtered, escaped data in the construction of thecommand to be executed:3.file( )；当allow_url_fopen = On;时file()可以读取远程文件
阅读全文
摘要：1.index.phpread()){if (substr($filename, 0, 5) == 'sess_'){$sess_data = file_get_contents("$path/$filename");if (!empty($sess_data)){session_decode($sess_data);$sess_data = $_SESSION;$_SESSION = array();$sess_name = substr($filename, 5);$sess_name = htmlentities($sess_name, ENT_QUO
阅读全文
摘要：iv = $iv;$crypt->ciphertext = $ciphertext;$crypt->decrypt();return $crypt->cleartext;}return '';}function _write($id, $data){This document was created by an unregistered ChmMagic, please go to http://www.bisenter.com to register it. Thanks .global $_sess_db;$access = time();$crypt =
阅读全文
摘要：The key types of cryptography with which a PHP developer should be familiar are as follows:Symmetric cryptographyAsymmetric (public key) cryptographyCryptographic hash functions (message digests)Message authentication codes (MACs)The majority of this appendix focuses on symmetric cryptography using
阅读全文
摘要：数据库安全SetEnv DB_USER "myuser"SetEnv DB_PASS "mypass"SetEnvis an Apache directive, and the format of this file instructs Apache to create environment variables for your database username andpassword. Of course, the key to this technique is that only the rootuser can read the file.
阅读全文
摘要：Most of the ideas in this section are hypothetical, although some have been implemented successfully. I would be interested to hear from people who try to implement anything on this page.If JavaScipt is not AvailableIf JavaScipt is not available, the site has a choice - it can either allow a login w
阅读全文
摘要：$username[$i],'password'=>$password[$i]); }}echo "检测到的用户名-密码";foreach ($hit as $item){ echo $item['username']."".$item['password']."";}
阅读全文
摘要：<?phpheader('Content-tyep:text/html;charset=utf8');$ch = curl_init();$url = "http://localhost/tp/target_ip.php";$header = array('CLIENT-IP:58.68.44.61','X-FORWARDED-FOR:58.68.44.61',);curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_HTTPHEADER, $heade
阅读全文
摘要：When to use JavaScript hashingIn general, it is best to use SSL to protect passwords. This provides stronger protection than any JavaScript hashing, and is becoming easier all the time. SSL certificates can now be obtainedfor free. Also, the performance impact of SSL is becoming less (more...). If S
阅读全文
摘要：通常情况下php是不知道sssion存储到哪的，可以使用下面的代码获取所有session文件数据read()){ if(substr($filename, 0,5)=='sess_') { $data=file_get_contents("$path/$filename"); if(!empty($data)) { session_decode($data); $session=$_SESSION; $_SESSION=array(); echo "Session [".substr($filename, 5)."]\n&quo
阅读全文
摘要：1.db security;table useruse security;create table user(username varchar(25) primary key,password varchar(32) not null,identifier varchar(32) ,token varchar(32) ,timeout int);2.登录页面3.处理登录页面dologin.php";echo $timeout;setcookie('auth',"$identifier:$token",$timeout);?>4.关键信息页面进
阅读全文
摘要：session_decode— Decodes session data from a stringDescriptionboolsession_decode( string$data)session_decode()decodes the session data indata, setting variables stored in the session.ParametersdataThe encoded data to be stored.Return ValuesReturnsTRUEon success orFALSEon failure.
阅读全文
浙公网安备 33010602011771号