Comment détecter et résoudre les problèmes de sécurité avec les pages Web à l'aide de PHP et de l'extension WebDriver

<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

// 创建连接
$conn = new mysqli($servername, $username, $password, $dbname);

// 检测连接
if ($conn->connect_error) {
    die("连接失败: " . $conn->connect_error);
}

// 使用预处理语句来查询数据库
$sql = "SELECT * FROM users WHERE username = ?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("s", $username);

// 执行查询
$stmt->execute();
$result = $stmt->get_result();

// 处理查询结果
while ($row = $result->fetch_assoc()) {
    echo "用户名: " . $row["username"]. "<br>";
}

// 关闭连接
$stmt->close();
$conn->close();
?>

<?php
// 检测输入
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $name = htmlspecialchars($_POST["name"]);
    $email = htmlspecialchars($_POST["email"]);
    $comment = htmlspecialchars($_POST["comment"]);
}
?>

<?php
require_once 'vendor/autoload.php';

use FacebookWebDriver;
use PHPUnitFrameworkTestCase;

class SecurityTest extends TestCase
{
    protected $driver;

    protected function setUp(): void
    {
        $options = new WebDriverChromeChromeOptions();
        $options->addArguments(['--headless']); // 在后台运行浏览器

        $capabilities = WebDriverRemoteDesiredCapabilities::chrome();
        $capabilities->setCapability(WebDriverChromeChromeOptions::CAPABILITY, $options);

        $this->driver = WebDriverRemoteRemoteWebDriver::create('http://localhost:9515', $capabilities);
    }

    public function testSQLInjection()
    {
        $this->driver->get('http://example.com/login');

        $usernameInput = $this->driver->findElement(WebDriverWebDriverBy::name('username'));
        $passwordInput = $this->driver->findElement(WebDriverWebDriverBy::name('password'));

        $usernameInput->sendKeys("admin' OR '1'='1");
        $passwordInput->sendKeys("password");

        $submitButton = $this->driver->findElement(WebDriverWebDriverBy::tagName('button'));
        $submitButton->click();

        $errorMessage = $this->driver->findElement(WebDriverWebDriverBy::className('error-message'))->getText();

        $this->assertEquals("用户名或密码错误", $errorMessage);
    }

    public function testXSSAttack()
    {
        $this->driver->get('http://example.com/comment');

        $commentInput = $this->driver->findElement(WebDriverWebDriverBy::name('comment'));

        $commentInput->sendKeys("<script>alert('XSS Attack')</script>");

        $submitButton = $this->driver->findElement(WebDriverWebDriverBy::tagName('button'));
        $submitButton->click();

        $commentText = $this->driver->findElement(WebDriverWebDriverBy::className('comment-text'))->getText();

        $this->assertEquals("&lt;script&gt;alert('XSS Attack')&lt;/script&gt;", $commentText);
    }

    protected function tearDown(): void
    {
        $this->driver->quit();
    }
}
?>