Guidelines for writing safe PHP code_PHP Tutorial

Never trust external data or input

The first thing you must realize about web application security is that external data should not be trusted. External data includes any data that is not entered directly by the programmer into the PHP code. Any data from any other source (such as GET variables, form POST, databases, configuration files, session variables, or cookies) cannot be trusted until steps are taken to ensure security.

For example, the following data elements can be considered safe because they are set in PHP.

<?php
$myUsername = 'tmyer';
$arrayUsers = array('tmyer', 'tom', 'tommy');
define("GREETING", 'hello there' . $myUsername);
?> 

However, the following data elements are flawed.

<?php
$myUsername = $_POST['username']; //tainted!
$arrayUsers = array($myUsername, 'tom', 'tommy'); //tainted!
define("GREETING", 'hello there' . $myUsername); //tainted!
?> 

Why is the first variable $myUsername defective? Because it comes directly from the form POST. Users can enter any string into this input field, including malicious commands to clean files or run previously uploaded files. You might ask, "Can't you avoid this danger by using a client-side (JavaScript) form validation script that only accepts the letters A-Z?" Yes, this is always a beneficial step, but as we'll see later , anyone can download any form to their machine, modify it, and resubmit whatever they need.

The solution is simple: the sanitization code must be run on $_POST['username']. If you don't do this, you risk polluting these objects any other time you use $myUsername (such as in an array or constant).

A simple way to sanitize user input is to use regular expressions to process it. In this example, only letters are expected to be accepted. It might also be a good idea to limit the string to a specific number of characters, or require all letters to be lowercase.

<?php
$myUsername = cleanInput($_POST['username']); //clean!
$arrayUsers = array($myUsername, 'tom', 'tommy'); //clean!
define("GREETING", 'hello there' . $myUsername); //clean!
function cleanInput($input){
    $clean = strtolower($input);
    $clean = preg_replace("/[^a-z]/", "", $clean);
    $clean = substr($clean,0,12);
    return $clean;
}
?> 

Disable PHP settings that make security difficult to implement

Now that you can’t trust user input, you should also know that you shouldn’t trust the way PHP is configured on your machine. For example, make sure register_globals is disabled. If register_globals is enabled, it's possible to do careless things like use a $variable to replace a GET or POST string with the same name. By disabling this setting, PHP forces you to reference the correct variables in the correct namespace. To use variables from a form POST, $_POST['variable'] should be quoted. This way you won't mistake this particular variable for a cookie, session, or GET variable.

If you can’t understand it, you can’t protect it

Some developers use strange syntax, or organize statements very compactly, resulting in short but ambiguous code. This approach may be efficient, but if you don't understand what the code is doing, you can't decide how to protect it.

For example, which of the two code snippets below do you like?

<?php 
//obfuscated code
$input = (isset($_POST['username']) ? $_POST['username']:'');
//unobfuscated code
$input = '';
if (isset($_POST['username'])){
    $input = $_POST['username'];
}else{
    $input = '';
}
?> 

In the second cleaner snippet, it's easy to see that $input is flawed and needs to be cleaned up before it can be safely processed.

"Defense in depth" is the new magic weapon

This tutorial will use examples to illustrate how to secure online forms while taking the necessary measures in the PHP code that handles the form. Likewise, even if you use PHP regex to ensure that GET variables are entirely numeric, you can still take steps to ensure that SQL queries use escaped user input.

Defense in depth is not just a good idea, it ensures that you don’t get into serious trouble.

Now that the basic rules have been discussed, let’s look at the first threat: SQL injection attacks.

In a SQL injection attack, the user adds information to a database query by manipulating a form or GET query string. For example, assume you have a simple login database. Each record in this database has a username field and a password field. Build a login form to allow users to log in.

Here is a simple login form:

<html>
<head>
<title>Login</title>
</head>
<body>
<form action="verify.php" method="post">
<p><label for='user'>Username</label>
<input type='text' name='user' id='user'/>
</p>
<p><label for='pw'>Password</label>
<input type='password' name='pw' id='pw'/>
</p>
<p><input type='submit' value='login'/></p>
</form>
</body>
</html> 

This form accepts user input for a username and password and submits the user input to a file called verify.php. In this file, PHP processes the data from the login form as follows:

<?php
$okay = 0;
$username = $_POST['user'];
$pw = $_POST['pw'];
$sql = "select count(*) as ctr from users where username='".$username."' and password='". $pw."' limit 1"; 
$result = mysql_query($sql);
while ($data = mysql_fetch_object($result)){
    if ($data->ctr == 1){
        //they're okay to enter the application!
        $okay = 1;
    }
}
if ($okay){
    $_SESSION['loginokay'] = true;
    header("index.php");
}else{
    header("login.php");
}
?> 

This code looks fine, right? Code like this is used by hundreds (if not thousands) of PHP/MySQL sites around the world. What's wrong with it? Well, remember "user input cannot be trusted". No information from the user is escaped here, thus leaving the application vulnerable. Specifically, any type of SQL injection attack is possible. For example, if the user enters foo as the username and ' or '1'='1 as the password, the following string is actually passed to PHP, which then passes the query to MySQL:

<?php 
$sql = "select count(*) as ctr  from users where username='foo' and password='' or '1'='1' limit 1"; 
?> 

This query always returns a count of 1, so PHP will allow access. By injecting some malicious SQL at the end of the password string, a hacker can impersonate a legitimate user.

解决这个问题的办法是，将 PHP 的内置 mysql_real_escape_string() 函数用作任何用户输入的包装器。这个函数对字符串中的字符进行转义，使字符串不可能传递撇号等特殊字符并让 MySQL 根据特殊字符进行操作。下面展示了带转义处理的代码。

<?php
$okay = 0;
$username = $_POST['user'];
$pw = $_POST['pw'];
$sql = "select count(*) as ctr from users where username='".mysql_real_escape_string($username)."' and password='". mysql_real_escape_string($pw)."' limit 1"; 
$result = mysql_query($sql);
while ($data = mysql_fetch_object($result)){
    if ($data->ctr == 1){
        //they're okay to enter the application!
        $okay = 1; 
    }
}
if ($okay){
    $_SESSION['loginokay'] = true;
    header("index.php");
}else{
    header("login.php");
}
?> 

使用 mysql_real_escape_string() 作为用户输入的包装器，就可以避免用户输入中的任何恶意 SQL 注入。如果用户尝试通过 SQL 注入传递畸形的密码，那么会将以下查询传递给数据库：

select count(*) as ctr from users where username='foo' and password='\' or \'1\'=\'1' limit 1" 

数据库中没有任何东西与这样的密码匹配。仅仅采用一个简单的步骤，就堵住了 Web 应用程序中的一个大漏洞。这里得出的经验是，总是应该对 SQL 查询的用户输入进行转义。

但是，还有几个安全漏洞需要堵住。下一项是操纵 GET 变量。

防止用户操纵 GET 变量

上面我们探讨了，防止了用户使用畸形的密码进行登录。如果您很聪明，应该应用您学到的方法，确保对 SQL 语句的所有用户输入进行转义。但是，用户现在已经安全地登录了。用户拥有有效的密码，并不意味着他将按照规则行事 —— 他有很多机会能够造成损害。例如，应用程序可能允许用户查看特殊的内容。所有链接指向 template.php?pid=33 或 template.php?pid=321 这样的位置。URL 中问号后面的部分称为查询字符串。因为查询字符串直接放在 URL 中，所以也称为 GET 查询字符串。

在 PHP 中，如果禁用了 register_globals，那么可以用 $_GET['pid'] 访问这个字符串。

<?php
$pid = $_GET['pid'];
//we create an object of a fictional class Page
$obj = new Page;
$content = $obj->fetchPage($pid);
//and now we have a bunch of PHP that displays the page
?> 

这里有什么错吗？首先，这里隐含地相信来自浏览器的 GET 变量 pid 是安全的。这会怎么样呢？大多数用户没那么聪明，无法构造出语义攻击。但是，如果他们注意到浏览器的 URL 位置域中的 pid=33，就可能开始捣乱。如果他们输入另一个数字，那么可能没问题；但是如果输入别的东西，比如输入 SQL 命令或某个文件的名称（比如 /etc/passwd），或者搞别的恶作剧，比如输入长达 3,000 个字符的数值，那么会发生什么呢？

在这种情况下，要记住基本规则，不要信任用户输入。应用程序开发人员知道 template.php 接受的个人标识符（PID）应该是数字，所以可以使用 PHP 的 is_numeric() 函数确保不接受非数字的 PID，如下所示：

<?php
$pid = $_GET['pid'];
if (is_numeric($pid)){
    //we create an object of a fictional class Page
    $obj = new Page;
    $content = $obj->fetchPage($pid);
    //and now we have a bunch of PHP that displays the page
}else{
    //didn't pass the is_numeric() test, do something else!
}
?> 

这个方法似乎是有效的，但是以下这些输入都能够轻松地通过 is_numeric() 的检查：

• 100 （有效）
• 100.1 （不应该有小数位）
• +0123.45e6 （科学计数法 —— 不好）
• 0xff33669f （十六进制 —— 危险！危险！）

那么，有安全意识的 PHP 开发人员应该怎么做呢？多年的经验表明，最好的做法是使用正则表达式来确保整个 GET 变量由数字组成，如下所示：

使用正则表达式限制 GET 变量：

<?php
$pid = $_GET['pid'];
if (strlen($pid)){
    if (!ereg("^[0-9]+$",$pid)){
        //do something appropriate, like maybe logging them out or sending them back to home page 
    }
}else{
    //empty $pid, so send them back to the home page
}
//we create an object of a fictional class Page, which is now
//moderately protected from evil user input
$obj = new Page;
$content = $obj->fetchPage($pid);
//and now we have a bunch of PHP that displays the page
?> 

需要做的只是使用 strlen() 检查变量的长度是否非零；如果是，就使用一个全数字正则表达式来确保数据元素是有效的。如果 PID 包含字母、斜线、点号或任何与十六进制相似的内容，那么这个例程捕获它并将页面从用户活动中屏蔽。如果看一下 Page 类幕后的情况，就会看到有安全意识的 PHP 开发人员已经对用户输入 $pid 进行了转义，从而保护了 fetchPage() 方法，如下所示：

对 fetchPage() 方法进行转义：

<?php
class Page{
    function fetchPage($pid){
        $sql = "select pid,title,desc,kw,content,status from page where pid='".mysql_real_escape_string($pid)."'"; 
    }
}
?> 

您可能会问，“既然已经确保 PID 是数字，那么为什么还要进行转义？” 因为不知道在多少不同的上下文和情况中会使用 fetchPage() 方法。必须在调用这个方法的所有地方进行保护，而方法中的转义体现了纵深防御的意义。

如果用户尝试输入非常长的数值，比如长达 1000 个字符，试图发起缓冲区溢出攻击，那么会发生什么呢？下一节更详细地讨论这个问题，但是目前可以添加另一个检查，确保输入的 PID 具有正确的长度。您知道数据库的 pid 字段的最大长度是 5 位，所以可以添加下面的检查。

使用正则表达式和长度检查来限制 GET 变量：

<?php
$pid = $_GET['pid'];
if (strlen($pid)){
    if (!ereg("^[0-9]+$",$pid) && strlen($pid) > 5){
        //do something appropriate, like maybe logging them out or sending them back to home page
    }
} else {
    //empty $pid, so send them back to the home page
}
    //we create an object of a fictional class Page, which is now
    //even more protected from evil user input
    $obj = new Page;
    $content = $obj->fetchPage($pid);
    //and now we have a bunch of PHP that displays the page
?> 

现在，任何人都无法在数据库应用程序中塞进一个 5,000 位的数值 —— 至少在涉及 GET 字符串的地方不会有这种情况。想像一下黑客在试图突破您的应用程序而遭到挫折时咬牙切齿的样子吧！而且因为关闭了错误报告，黑客更难进行侦察。

缓冲区溢出攻击

缓冲区溢出攻击 试图使 PHP 应用程序中（或者更精确地说，在 Apache 或底层操作系统中）的内存分配缓冲区发生溢出。请记住，您可能是使用 PHP 这样的高级语言来编写 Web 应用程序，但是最终还是要调用 C（在 Apache 的情况下）。与大多数低级语言一样，C 对于内存分配有严格的规则。

缓冲区溢出攻击向缓冲区发送大量数据，使部分数据溢出到相邻的内存缓冲区，从而破坏缓冲区或者重写逻辑。这样就能够造成拒绝服务、破坏数据或者在远程服务器上执行恶意代码。

防止缓冲区溢出攻击的惟一方法是检查所有用户输入的长度。例如，如果有一个表单元素要求输入用户的名字，那么在这个域上添加值为 40 的 maxlength 属性，并在后端使用 substr() 进行检查。下面给出表单和 PHP 代码的简短示例。

<?php
if ($_POST['submit'] == "go"){
    $name = substr($_POST['name'],0,40);
}
?>
<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
<p><label for="name">Name</label>
<input type="text" name="name" id="name" size="20" maxlength="40"/></p>
<p><input type="submit" name="submit" value="go"/></p>
</form> 

为什么既提供 maxlength 属性，又在后端进行 substr() 检查？因为纵深防御总是好的。浏览器防止用户输入 PHP 或 MySQL 不能安全地处理的超长字符串（想像一下有人试图输入长达 1,000 个字符的名称），而后端 PHP 检查会确保没有人远程地或者在浏览器中操纵表单数据。

正如您看到的，这种方式与前面使用 strlen() 检查 GET 变量 pid 的长度相似。在这个示例中，忽略长度超过 5 位的任何输入值，但是也可以很容易地将值截短到适当的长度，如下改变输入的 GET 变量的长度所示：

<?php
$pid = $_GET['pid'];
if (strlen($pid)){
    if (!ereg("^[0-9]+$",$pid)){
        //if non numeric $pid, send them back to home page
    }
}else{
    //empty $pid, so send them back to the home page
}
    //we have a numeric pid, but it may be too long, so let's check
    if (strlen($pid)>5){
        $pid = substr($pid,0,5);
    }
    //we create an object of a fictional class Page, which is now
    //even more protected from evil user input
    $obj = new Page;
    $content = $obj->fetchPage($pid);
    //and now we have a bunch of PHP that displays the page
?> 

注意，缓冲区溢出攻击并不限于长的数字串或字母串。也可能会看到长的十六进制字符串（往往看起来像 \xA3 或 \xFF）。记住，任何缓冲区溢出攻击的目的都是淹没特定的缓冲区，并将恶意代码或指令放到下一个缓冲区中，从而破坏数据或执行恶意代码。对付十六进制缓冲区溢出最简单的方法也是不允许输入超过特定的长度。

如果您处理的是允许在数据库中输入较长条目的表单文本区，那么无法在客户端轻松地限制数据的长度。在数据到达 PHP 之后，可以使用正则表达式清除任何像十六进制的字符串。

防止十六进制字符串：

<?php
if ($_POST['submit'] == "go"){
    $name = substr($_POST['name'],0,40);
    //clean out any potential hexadecimal characters
    $name = cleanHex($name);
    //continue processing....
}
function cleanHex($input){
    $clean = preg_replace("![\][xX]([A-Fa-f0-9]{1,3})!", "",$input);
    return $clean; 
}
?>
<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
<p><label for="name">Name</label>
<input type="text" name="name" id="name" size="20" maxlength="40"/></p>
<p><input type="submit" name="submit" value="go"/></p>
</form> 

您可能会发现这一系列操作有点儿太严格了。毕竟，十六进制串有合法的用途，比如输出外语中的字符。如何部署十六进制 regex 由您自己决定。比较好的策略是，只有在一行中包含过多十六进制串时，或者字符串的字符超过特定数量（比如 128 或 255）时，才删除十六进制串。

跨站点脚本攻击

在跨站点脚本（XSS）攻击中，往往有一个恶意用户在表单中（或通过其他用户输入方式）输入信息，这些输入将恶 意的客户端标记插入过程或数据库中。例如，假设站点上有一个简单的来客登记簿程序，让访问者能够留下姓名、电子邮件地址和简短的消息。恶意用户可以利用这 个机会插入简短消息之外的东西，比如对于其他用户不合适的图片或将用户重定向到另一个站点的 Javascrīpt，或者窃取 cookie 信息。幸运的是，PHP 提供了 strip_tags() 函数，这个函数可以清除任何包围在 HTML 标记中的内容。strip_tags() 函数还允许提供允许标记的列表，比如 或 。

<?php
if ($_POST['submit'] == "go"){
    //strip_tags
    $name = strip_tags($_POST['name']);
    $name = substr($name,0,40);
    //clean out any potential hexadecimal characters
    $name = cleanHex($name);
    //continue processing....
}
function cleanHex($input){ 
    $clean = preg_replace("![\][xX]([A-Fa-f0-9]{1,3})!", "",$input);
    return $clean;
}
?>
<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
<p><label for="name">Name</label>
<input type="text" name="name" id="name" size="20" maxlength="40"/></p>
<input type="hidden" name="table" value="users"/>
<input type="hidden" name="action" value="create"/>
<input type="hidden" name="status" value="live\"/>
<p><input type="submit" name="submit" value="go"/></p>
</form> 

<?php
session_start();
if ($_POST['submit'] == "go"){
    //check token
    if ($_POST['token'] == $_SESSION['token']){
        //strip_tags
        $name = strip_tags($_POST['name']);
        $name = substr($name,0,40);
        //clean out any potential hexadecimal characters
        $name = cleanHex($name);
        //continue processing....
    }else{
        //stop all processing! remote form posting attempt!
    }
}
$token = md5(uniqid(rand(), true));
$_SESSION['token']= $token;
function cleanHex($input){
    $clean = preg_replace("![\][xX]([A-Fa-f0-9]{1,3})!", "",$input);
    return $clean;
}
?>
<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
<p><label for="name">Name</label>
<input type="text" name="name" id="name" size="20" maxlength="40"/></p>
<input type="hidden" name="token" value="<?php echo $token;?>"/>
<p><input type="submit" name="submit" value="go"/></p>
</form>