1. File system security
If php has root authority and allows users to delete files in the script, then the user submits data without filtering, and it is very likely to delete system files
<?php
// delete the specified file from the user directory
$username = $_POST['user_submitted_name'];
$userfile = $_POST['user_submitted_filename'];
$homedir = "/home/$username";
unlink ("$ homedir/$userfile");
echo "The file has been deleted!";
?>
The above code, assuming that the $userfile value submitted by the user is ../etc/, then the /etc directory will be deleted to
prevent file system attacks, The strategy is as follows
Variables submitted by users with limited privileges in PHP must be monitored and filtered, and cannot contain special characters such as file paths.
Try to avoid using PHP to manipulate files (delete). If there is a need in this regard, the files that users can delete must also be generated by the system. The random name of the database cannot be controlled by the user
. Second, database
security The main defense of database security is sql injection, that is, sql injection attacks. The strategies to improve database security are as follows:
You do not need to use the root account or the database owner account to connect to the database. Connect to the database to limit the ip of the connecting user to
use the pdo extension of php, which can effectively prevent sql injection. In addition to the advantages of security, the pdo extension of php has great advantages in terms of performance.
Please refer to http://php.net/manual/en/pdo.prepared-statements.php
encrypts some sensitive information, such as password encryption
. 3. User data filtering Filtering
of user data can prevent XSS and CSRF attacks
Using the whitelist (user input is a fixed mode) method,
such as the user name can only use numbers and letters, then you can use the function ctype_alnum to judge
the user input using the function htmlentities or htmlspecialchars to process, the input url is not allowed to pass in non-http protocol
user authentication Using the token (csrf)
http://htmlpurifier.org/ HTML Purifier is an open source effective solution to prevent xss attacks.
Fourth, other security policies
are closed for online environment error reporting (error_reporting, dislay_erros, available in php.ini Configure the error_log path and record error information, which helps to find possible user attacks)
Register Globals, deprecated (removed) features, do not use the
magic quotes feature, do not enable it, it has been removed in PHP-5.4,
try to use it The latest version of PHP, the latest version fixes many known PHP security holes and bugs
Strictly abide by the above policies in the code can basically ensure that the code will not have too many security loopholes and can prevent common attacks.