Common PHP security attacks and solutions

This article mainly shares with you common PHP security attacks and solutions. Understanding common PHP application security threats can ensure that your PHP application is not attacked. Therefore, this article will list 6 common PHP security attacks. Everyone is welcome to read and learn.

1. SQL injection

SQL injection is a malicious attack in which users enter SQL statements into form fields to affect normal SQL execution. There is also one injected through the system() or exec() command, which has the same SQL injection mechanism, but only targets shell commands.

01    $username = $_POST[&#39;username&#39;];02    $query = "select * from auth where username = &#39;".$username."&#39;";03    echo $query;04    $db = new mysqli(&#39;localhost&#39;, &#39;demo&#39;, ‘demo&#39;, ‘demodemo&#39;);05    $result = $db->query($query);06    if ($result && $result->num_rows) {07        echo "<br />Logged in successfully";08    } else {09        echo "<br />Login failed";10    }

The above code does not filter or escape the user-entered value ($_POST['username']) on the first line. So the query may fail, or even corrupt the database, depending on whether $username contains transform your SQL statement into something else.

Prevent SQL injection

Options:

使用mysql_real_escape_string()过滤数据
手动检查每一数据是否为正确的数据类型
使用预处理语句并绑定变量

Use prepared prepared statements

分离数据和SQL逻辑
预处理语句将自动过滤（如：转义）
把它作为一个编码规范，可以帮助团队里的新人避免遇到以上问题

01    $query = 'select name, district from city where countrycode=?';02    if ($stmt = $db->prepare($query) )03    {04        $countrycode = 'hk';05        $stmt->bind_param("s", $countrycode); 
06        $stmt->execute();07        $stmt->bind_result($name, $district);08        while ( $stmt ($stmt->fetch() ){09            echo $name.', '.$district;10            echo '<br>';11        }12        $stmt->close();13    }

2. XSS attack

XSS( A cross-site scripting attack) is an attack in which a user enters some data into your website, which includes client-side script (usually JavaScript). If you output data to another web page without filtering, this script will be executed.

Receive user-submitted text content

01    <?php02    if (file_exists(&#39;comments&#39;)) {03        $comments = get_saved_contents_from_file(&#39;comments&#39;);04    } else {05        $comments = &#39;&#39;;06    }07     08    if (isset($_POST[&#39;comment&#39;])) {09        $comments .= &#39;<br />&#39; . $_POST[&#39;comment&#39;];10        save_contents_to_file(&#39;comments&#39;, $comments);11    }12    >
输出内容给（另一个）用户1    <form action=&#39;xss.php&#39; method=&#39;POST&#39;>2    Enter your comments here: <br />3    <textarea name=&#39;comment&#39;></textarea> <br />4    <input type=&#39;submit&#39; value=&#39;Post comment&#39; />5    </form><hr /><br />6     7    <?php echo $comments; ?>

What will happen?

烦人的弹窗
刷新或重定向
损坏网页或表单
窃取cookie
AJAX（XMLHttpRequest）

Prevent XSS attacks: In order to prevent XSS attacks, use PHP's htmlentities() function to filter and then output to the browser. Basic usage of htmlentities() is simple, but there are many advanced controls available, see the XSS Cheat Sheet.

3. Session fixation

Session security assumes that a PHPSESSID is difficult to guess. However, PHP can accept a session ID via a cookie or URL. Therefore, spoofing a victim can use a specific (or other) session ID or phishing attack.

4. Session Capture and Hijacking

This is the same idea as session fixation, however, it involves stealing the session ID. If the session ID is stored in a cookie, it can be stolen by an attacker via XSS and JavaScript. If the session ID is included in the URL, it can also be obtained through sniffing or from the proxy server.

Prevent session capture and hijacking

更新ID
如果使用会话，请确保用户使用SSL

5. Cross-site request forgery (CSRF)

CSRF attack refers to a request made by a page that looks like a website of trusting users, but not intentionally. It has many variations, such as the following example:

1    ![](http://example.com/single_click_to_buy.php?user_id=123&item=12345)

Preventing cross-site request forgery

In general, make sure the user comes from your form, and match every form you send out . There are two points that must be remembered:

对用户会话采用适当的安全措施，例如:给每一个会话更新id和用户使用SSL。
生成另一个一次性的令牌并将其嵌入表单，保存在会话中(一个会话变量)，在提交时检查它。

6. Code injection

Code injection is caused by using computer vulnerabilities to process invalid data. The problem comes when you accidentally execute arbitrary code, usually via file inclusion. Poorly written code can allow a remote file to be included and executed. Like many PHP functions, such as require can contain a URL or file name, for example:

01    <form>Choose theme:02        <select name = theme>03            <option value = blue>Blue</option>04            <option value = green>Green</option>05            <option value = red>Red</option>06        </select>07        <input type = submit>08    </form>09    <?php10        if($theme) {11            require($theme.&#39;.txt&#39;);12        }13    ?>

In the above example, by passing a file name or part of a file name entered by the user, it contains the URL or file name, starting with "http:/ Files starting with /".

Preventing code injection

过滤用户输入
在php.ini中设置禁用allow_url_fopen和allow_url_include。这将禁用require/include/fopen的远程文件。

Other general principles

1. Do not rely on server configuration to protect your application, especially when your web server/ PHP is managed by your ISP, or when your website may be moved/deployed elsewhere, it may be moved/deployed elsewhere in the future. Please embed security-aware checks/logic in your website code (HTML, JavaScript, PHP, etc.).

2. Design server-side security scripts:
   —For example, use a single line of execution - single point of authentication and data sanitization
   —For example, embed a PHP in all security-sensitive pages Function/file that handles all login/security logic checks

3. Make sure your code is updated and patched with the latest updates.

Related recommendations:

Detailed explanation of PHP security examples

Upload images securely with PHP

Detailed summary of PHP security configuration records and common errors

The above is the detailed content of Common PHP security attacks and solutions. For more information, please follow other related articles on the PHP Chinese website!