【1. Configuration on the server side】
Safety, PHP code writing is one aspect, and PHP configuration is very critical.
We installed PHP manually. The default configuration file of PHP is in /usr/local/apache2/conf/php.ini. Our most important thing is to configure the content in php.ini so that we can execute PHP more safely. . The security settings in the entire PHP are mainly to prevent attacks from phpshell and SQL Injection. Let’s discuss it slowly. We first use any editing tool to open /etc/local/apache2/conf/php.ini. If you install it in other ways, the configuration file may not be in this directory.
(1) Turn on php’s safe mode
php’s safe mode is a very important built-in security mechanism that can control some functions in php, such as system(),
The file operation function performs permission control and does not allow certain key files, such as /etc/passwd,
But the default php.ini does not open safe mode, we open it:
safe_mode = on
(2) User group security
When safe_mode is turned on, safe_mode_gid is turned off, then the php script can access the file, and users in the same
group can also access the file access.
It is recommended to set it to:
safe_mode_gid = off
If it is not set, we may not be able to operate the files in the directory of our server website. For example, we need to
operate the files when.
(3) Home directory for executing programs in safe mode
If safe mode is turned on, but you want to execute certain programs, you can specify the home directory for executing programs:
safe_mode_exec_dir = D:/usr/bin
Under normal circumstances, there is no need to execute any program, so it is recommended not to execute the system program directory. You can point to a directory,
and then copy the program that needs to be executed, such as:
safe_mode_exec_dir = D:/tmp/cmd
However, I recommend not to execute any program, then you can point to our web directory:
safe_mode_exec_dir = D:/usr/www
( 4) Include files in safe mode
If you want to include some public files in safe mode, then modify the options:
safe_mode_include_dir = D:/usr/www/include/
In fact, it’s normal The files included in the php script have been written in the program itself, and this can be set according to specific needs.
(5) Control the directories that the PHP script can access
Use the open_basedir option to control the PHP script to only access the specified directory. This can prevent the PHP script from accessing files that should not be accessed to a certain extent. To limit the harm of phpshell, we can generally set it to only access the website directory:
open_basedir = D:/usr/www
(6) Turn off dangerous functions
If safe mode is turned on, Then function prohibition is not necessary, but we still consider it for safety. For example,
we feel that we do not want to execute php functions including system() that can execute commands, or
phpinfo() and other functions that can view php information, then we can ban them:
disable_functions = system,passthru,exec,shell_exec,popen,phpinfo
If you want to prohibit any file and directory operations, you can turn off many file operations
disable_functions = chdir,chroot,dir,getcwd ,opendir,readdir,scandir,fopen,unlink,delete,copy,mkdir, rmdir,rename,file,file_get_contents,fputs,fwrite,chgrp,chmod,chown
The above only lists some of the commonly used file processing functions. You can also combine the above execution command function with this function,
to resist most phpshells.
(7) Turn off the leakage of PHP version information in the http header
In order to prevent hackers from obtaining the PHP version information in the server, we can turn off the leakage of the information in the http header:
expose_php = Off
For example, when a hacker telnet www.12345.com 80, he will not be able to see PHP information.
(8) Turn off registration of global variables
Variables submitted in PHP, including variables submitted using POST or GET, will be automatically registered as global variables and can be accessed directly,
This is correct The server is very unsafe, so we cannot let it be registered as a global variable, so we turn off the register global variable option:
register_globals = Off
Of course, if it is set like this, then you need to get the corresponding variable Use reasonable methods, such as obtaining the variable var submitted by GET,
then use $_GET['var'] to obtain it, PHP programmers should pay attention to this.
(9) Turn on magic_quotes_gpc to prevent SQL injection
SQL injection is a very dangerous problem. In small cases, the website backend is invaded, and in serious cases, the entire server collapses,
so be careful. There is a setting in php.ini:
magic_quotes_gpc = Off
This is turned off by default. If it is turned on, it will automatically convert user-submitted SQL queries,
for example, convert ' to 'Wait, this plays a significant role in preventing sql injection. So we recommend setting it to:
magic_quotes_gpc = On
(10) Error message control
Generally, php will prompt an error when it is not connected to the database or under other circumstances. Generally, the error message will include php The script path information before
or the query SQL statement and other information are not safe after this kind of information is provided to hackers, so it is generally recommended that the server disable error prompts:
display_errors = Off
If you want to display error information, be sure to set the level of error display, for example, only display information above warnings:
error_reporting = E_WARNING & E_ERROR
Of course, I still recommend turning off error prompts.
(11) Error log
It is recommended to record the error information after turning off display_errors, so as to find the reason why the server is running:
log_errors = On
Also set up error log storage directory, it is recommended that the root apache log exists together:
error_log = D:/usr/local/apache2/logs/php_error.log
Note: The file must allow the apache user and group to have write permissions .
MYSQL running with reduced privileges
Create a new user such as mysqlstart
net user mysqlstart fuckmicrosoft /add
net localgroup users mysqlstart /del
does not belong to any Group
If MYSQL is installed in d:mysql, then give mysqlstart full control permission
Then set the service properties of MYSQL in the system service. In the login properties, select this user mysqlstart and enter the password, OK.
Restart the MYSQL service, and then MYSQL will run with low privileges.
If the apache is built on the windos platform, we need to pay attention to one more thing. By default, apache runs with system permissions.
This is scary and makes people feel very uncomfortable. Then let’s lower the permissions of apache. .
net user apache fuckmicrosoft /add
net localgroup users apache /del
ok. We created a user apche that does not belong to any group.
We open the computer manager, select services, click on the properties of the apache service, we select log on, select this account, we fill in the account and password created above,
Restart the apache service, ok, apache Runs with low privileges.
In fact, we can also set the permissions of each folder so that the apache user can only perform what we want it to do, and create a separate read-write user for each directory.
This is also a popular configuration method used by many virtual host providers. However, this method is overkill when used to prevent this.
【2. Writing in PHP code】
Although many domestic PHP programmers still rely on addslashes to prevent SQL injection, it is recommended that everyone strengthen checks to prevent SQL injection in Chinese. The problem with addslashes is that hackers can use 0xbf27 to replace single quotes, while addslashes only changes 0xbf27 to 0xbf5c27, which becomes a valid multi-byte character. 0xbf5c is still regarded as a single quote, so addslashes cannot successfully intercept.
Of course, addslashes is not useless. It is used for processing single-byte strings. For multi-byte characters, use mysql_real_escape_string.手 For the example of get_magic_quotes_gpc in the php manual:
(! Get_magic_quotes_gpc ()) {
$ LastName = addslashes ($ _ Post ['LastName']); $ lastname = $_POST['lastname'];
}
It is best to check $_POST[’lastname’] when magic_quotes_gpc is already open.
Let’s talk about the difference between the two functions mysql_real_escape_string and mysql_escape_string:
mysql_real_escape_string must be used under (PHP 4 >= 4.3.0, PHP 5). Otherwise, you can only use mysql_escape_string. The difference between the two is: mysql_real_escape_string takes into account the current character set of the connection, while mysql_escape_string does not.
To summarize:
* addslashes() is a forced addition;
* mysql_real_escape_string() will determine the character set, but there are requirements for the PHP version;
* mysql_escape_string does not consider the current character set of the connection.
-------------------------------------------------- --------------------------------------------------
When coding in PHP, if you consider some basic security issues, first of all:
1. Initialize your variables
Why do you say this? Let's look at the following code:
PHP code
';
include('admin.php');
} else 'You are not an administrator and cannot manage! ' ; For example, our page is http://daybook.diandian.com/login.php, then we submit: http://daybook.diandian.com/login.php?admin=1, haha, think about it, we are Either you are an administrator directly, you manage it directly.
Of course, maybe we won’t make such a simple mistake, then some very secret mistakes may also cause this problem. For example, there is a loophole in the phpwind forum, which allows us to directly obtain administrator rights because of the $skin The variables are not initialized, which leads to a series of problems later. So how do we avoid the above problems? First, start with php.ini and set register_global =off in php.ini, which means that not all registered variables are global, so this can be avoided. However, we are not server administrators and can only improve the code. So how do we improve the above code? We rewrite it as follows:
PHP code pass'])
{echo 'Login successful! ';
include('admin.php');
} else 'You are not an administrator and cannot manage! ';
} }
?> Initialize the variable to $admin = 0, then you will not be able to obtain administrator privileges through this vulnerability.
2. Prevent SQL Injection (sql injection)
SQL injection should be the most harmful program at present, including the earliest from asp to php, which are basically popular technologies in the country in the past two years. The basic principle is to Submitting variables without filtering creates an injection point and then allows malicious users to submit some SQL query statements, causing important data to be stolen, data lost or damaged, or to be invaded into the backend management.
So now that we understand the basic injection invasion methods, how can we prevent it? We should start with the code.
We know that there are two ways to submit data on the Web, one is get and the other is post. So many common SQL injections start from the get method, and the injection statements must contain some SQL statements. Because there is no sql statement, how to proceed? There are four major sql statements: select, update, delete, and insert. So if we filter the data we submit, can we avoid these problems?
So we use regular expressions to construct the following function:
PHP code
return eregi('select|insert|update| delete|'| function verify_id($id=null) { elseif (inject_check($id)) { exit('The submitted parameters are illegal!'); } // Injection judgment
elseif (!is_numeric($id)) { exit('The submitted parameters are illegal!'); } / / Numerical judgment
Haha, then we can verify , so our program code above becomes the following:
PHP code
}
else please continue! ' ;
For example, some characters may cause harm to the database, such as ' _ ', ' %'. These characters have special meanings, so what if we control them? Another point is that when magic_quotes_gpc = off in our php.ini, the submitted data that does not comply with the database rules will not automatically add ' ' in front. Then we need to control these problems, so we build it as follows Function:
PHP code get_magic_quotes_gpc()) // Determine whether magic_quotes_gpc is turned on
$str = addslashes($str); // Filter out
}
$str = str_replace("_", "_", $str); // Filter out '_'
$str = str_replace("%", "%", $str); // Filter out the '%'
We are here again This avoids the risk of the server being compromised.
Finally, consider submitting some large batches of data, such as posting, or writing articles or news. We need some functions to help us filter and convert. Based on the above functions, we build the following functions:
PHP code
) // Determine whether magic_quotes_gpc is open = addslashes($post); // Filter the submitted data when magic_quotes_gpc is not opened
} }
$post = str_replace("_", "_", $post); // Filter out '_'
$post = str_replace("%", "%", $post); // Filter out ' % 'Filter out
$post = nl2br($post); // Enter conversion
$post= htmlspecialchars($post); // html tag conversion
return $post;
} };? & Gt; & 呵, basically here, we have told some situations. In fact, I think there are very few things I say. At least I only talk about two aspects, and there are very few in the whole security. content, I will consider talking more about it next time, including PHP security configuration, Apache security, etc., so that our security can be integrated as a whole and be the safest.
Finally, let me tell you what is expressed above: 1. Initialize your variables 2. Be sure to filter your variables
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
