In three minutes, you will learn about the dangerous functions you need to pay attention to when operating user-submitted content in PHP.

This article will introduce you to the dangerous functions that you need to pay attention to when operating user-submitted content in PHP. It has certain reference value. Friends in need can refer to it. I hope it will be helpful to everyone.

For our program development, user input is the first entry point to solve security problems. Why do you say that? Whether it is SQL injection, XSS or file upload vulnerabilities, they are all related to the input parameters submitted by the user. Today we will not talk about these issues. We will mainly discuss the following user input. There are some dangerous functions that cannot be directly used for operations without verification, such as:

include($g);

Assumption This $g is the content submitted by the user. We use this parameter directly to include the file without verification. The parameter we pass is ?g=/etc/passwd, then all user account information on the server is likely to be It was leaked directly.

In addition, some functions that execute shell commands are extremely dangerous.

echo system($g);

When the parameter we pass is ?g=ls -la /, the same server directory is also displayed. This only shows the directory structure. If other more terrifying commands are used, the consequences will be disastrous.

Similarly, we often operate files based on some IDs or specified file names, especially when deleting files. If we do not make a judgment, we may directly delete some very important files.

unlink('./' . $g);

We continue to construct $g as ?g=../../../xxxx. If permissions allow, various system files can be deleted.

Regarding these contents, in fact, some good suggestions have been given in the official PHP manual. We might as well take a look directly at what the PHP manual says.

The major weaknesses in many PHP programs are not problems with the PHP language itself, but are caused by programmers' low security awareness. Therefore, you must always pay attention to possible problems in each piece of code to discover the possible impact of incorrect data submission.

Always pay attention to your code to ensure that every variable submitted from the client is properly checked, and then ask yourself some questions:

• This script Can it only affect the intended files?

• Can abnormal data have any effect after being submitted?

• Can this script be used for unintended purposes?

• Can this script be combined with other scripts to do bad things?

• Are all transactions adequately recorded?

Also consider turning off register_globals, magic_quotes or other settings that make programming more convenient but will confuse the legality, source and value of a variable. During development, you can use the error_reporting(E_ALL) mode to help check whether variables have been checked or initialized before use, so as to prevent some abnormal data from being messed up.

In fact, as long as these suggestions are followed, most safety problems can be solved. Again, you cannot trust any user output. Please do various verifications during testing, including but not limited to boundary values, special symbols, special commands, out-of-bounds values, directory permissions, etc. Do not use user input as direct parameters for files, script execution, and file operations unless necessary. If you must use it, you must perform various forms of filtering and verification.

Test code:

[https://github.com/zhangyue05...

Recommended learning: php video tutorial

The above is the detailed content of In three minutes, you will learn about the dangerous functions you need to pay attention to when operating user-submitted content in PHP.. For more information, please follow other related articles on the PHP Chinese website!