没有合适的资源？快使用搜索试试~ 我知道了~

首页保障用户安全：编写稳健PHP应用指南

保障用户安全：编写稳健PHP应用指南

Secure

Apps

5星 · 超过95%的资源需积分: 9 86 下载量 40 浏览量更新于2024-07-21 收藏 710KB PDF 举报

身份认证购VIP最低享 7 折!

30元优惠券

试读

102页

"《构建安全的PHP应用》是一本由Ben Edmunds撰写的实用手册，旨在帮助开发者确保他们的PHP应用程序免受黑客攻击，保护用户敏感数据的安全。书中针对初学者到专业人士，提供了清晰、可操作的指导，涵盖了以下关键主题： 1. 永不信任用户：所有输入都要进行转义 - 作者强调了在处理用户输入时的重要性，防止SQL注入攻击，确保代码对恶意输入具有防御性。 2. HTTPS/SSL/加密技术 - 提供了关于使用安全套接字层（SSL）和不同加密算法（如BCA、JWH和SHA）的深入解释，这些技术对于保护数据传输至关重要。 3. 密码加密与存储 - 教授如何正确地加密和存储用户的密码，以防止数据泄露，确保密码安全。 4. 身份验证、访问控制与安全文件操作 - 涵盖了如何实现有效的身份验证机制，以及如何实施访问控制，避免恶意文件操作。 5. 安全默认设置、跨站脚本攻击及其他常见漏洞 - 提醒开发者注意常见的安全陷阱，如跨站脚本（XSS）攻击，并提供防范策略。作为一本 Leanpub 出版的书籍，它是一个持续更新的过程，作者鼓励读者参与反馈，共同改进内容。书中的示例代码全部采用PHP编写，并可在GitHub上获取源代码。《构建安全的PHP应用》不仅适合初学者学习基础安全实践，也适合经验丰富的开发人员提升现有项目的安全性。通过阅读这本书，开发者可以增强自己应用的安全性，减少数据丢失的风险，确保用户信息的安全，从而提高整体系统的可靠性。这是一本可以帮助开发者提升技能、保障网络安全的实用指南，让每一个PHP应用都能让用户安心使用，开发者无后顾之忧。"

资源详情

资源推荐

Chapter 1 - Never Trust Your Users. Sanitize ALL Input! 11

1 <form action="...">

2 <input type="text" name="first_name" />

3 <input type="text" name="last_name" />

4 <input type="text" name="email" />

5 <input type="hidden" name="permissions" value="{\

6 'admin':'true'}" />

7 </form>

That same code would now change this user’s permissions

erroneously.

This may sound like a dumb problem to solve, but it is one

that a lot of developers and sites have fallen victim to. The

most recent, well-known exploit of this vulnerability was

when a user exposed that Ruby on Rails was susceptible to

this. When Egor Homakov originally reported to the Rails

team that new Rails installs were insecure, his bug report

was rejected. The core team thought it was a minor concern

that would be easier for new developers to leave enabled by

default. To get attention to this issue, Homakov hilariously

“hacked” Rails’ GitHub account (GitHub is built on Rails)

to give himself administrative rights to their repositories.

Needless to say, this proved his point, and now Rails (and

GitHub) are protected from this attack by default.

How do you protect your application against this? The exact

implementation details depend on which framework or code

base you’re using, but you have a few options:

• Turn off mass assignment completely

• Whitelist the fields that are safe to be mass assigned

• Blacklist the fields that are not safe to be mass assigned

Chapter 1 - Never Trust Your Users. Sanitize ALL Input! 12

Depending on your implementation, some of these may be

used simultaneously.

In Laravel you add a $fillable property to your models to

set the whitelist of fields that are mass assignable:

1 class User extends Eloquent {

3 protected $table = 'users';

5 protected $fillable = ['first_name', 'last_name'\

6 , 'email'];

This would stop the “permissions” column from being mass

assigned. Another way to handle this in Laravel is to set a

blacklist with the $guarded property:

1 class User extends Eloquent {

3 protected $table = 'users';

5 protected $guarded = ['permissions'];

The choice is up to you, depending on which is easier in your

application.

If you don’t use Laravel, your framework probably has a

similar method of whitelisting/blacklisting mass assignable

fields. If you use a custom framework, get on implementing

whitelists and blacklists!

Chapter 1 - Never Trust Your Users. Sanitize ALL Input! 13

Typecasting

One additional step I like to take, not just for security but also

for data integrity, is to typecast known formats. Since PHP is a

dynamically typed language⁸, a value can be any type: string,

integer, float, etc. By typecasting the value, we can verify that

the data matches what we expect. In the previous example,

if the ID was coming from a variable it would make sense to

typecast it if we knew it should always be an integer, like this:

1 $id = (int) 1001;

3 $db = new PDO(...);

4 $query = $db->prepare('UPDATE users

5 SET first_name = :first_name

6 WHERE id = :id');

8 $query->execute([

9 ':id' => $id, //we know its an int

10 ':first_name' => $_POST['first_name']

11 ]);

In this case it wouldn’t matter much since we are defining

the ID ourselves, so we know its an integer. But if the ID

came from a posted form or another source, this would give

us additional peace of mind.

PHP supports a number of types that you can cast to, they are

⁸http://stackoverflow.com/questions/7394711/what-is-dynamic-typing

Chapter 1 - Never Trust Your Users. Sanitize ALL Input! 14

1 $var = (array) $var;

2 $var = (binary) $var;

3 $var = (bool) $var;

4 $var = (boolean) $var;

5 $var = (double) $var;

6 $var = (float) $var;

7 $var = (int) $var;

8 $var = (integer) $var;

9 $var = (object) $var;

10 $var = (real) $var;

11 $var = (string) $var;

This is helpful not only when dealing with your database, but

throughout your application. Just because PHP is dynamically

typed doesn’t mean that you can’t enforce typing in certain

places. Yeah science!

Chapter 1 - Never Trust Your Users. Sanitize ALL Input! 15

Sanitizing Output

Outputting to the Browser

Not only should you take precautions when saving the data

you take in, you should sanitize / escape any user-generated

data that is output back to the browser.

You can modify and escape your data prior to saving to the

database, or in between retrieving it and outputting to the

browser. It usually depends on how your data is edited and

used. For example, if the user is editing the data later, it

usually makes more sense to save it as-is, and sanitize upon

output.

What security benefits come from escaping user-generated

data that you output? Suppose a user submits the following

JavaScript snippet to your application, which saves it for

outputting later:

If you don’t sanitize this code before you echo it out to the

browser, the malicious JavaScript will run normally, as if you

wrote it yourself. In this case it’s a harmless alert(), but a

hacker won’t be nearly as kind.

Another popular place for this type of exploit is in an image’s

XIFF data. If a user uploads an image and your application

displays the XIFF data, it will need to be sanitized as well.

Anywhere you are displaying data that came into your app

from the outside, you need to sanitize it.

If you’re using a templating library or a framework that

handles templating, escaping may happen automatically, or

剩余101页未读，继续阅读

帮我写成完整的代码#define N 3; class CHouse { private: char mName[20]; //地址 float mPrice; //单价 float mArea; //面积 public: float getprice() { return mPrice; } float getarea() { return mArea; } void set(char* name, float price, float area); //修改房屋参数 CHouse(char* name=0,float price=0,float area=0); //构造函数 friend ifstream& operator>> (ifstream &is, CHouse &house); //从文件中读取一个房屋参数 friend ostream& operator<< (ostream &is, CHouse &house); }; class CBuilding //大楼 { private: CHouse mHouse; int mNums; int size; public: CBuilding(int m = N) { mHouse = new CHouse[m]; size = m; mNums = 0; } float Total(); //计算大楼所有房屋的总价值 void AddHouse(char name,float price,float area); //加入房屋到大楼中,注意空间是否超出 void ReadData(char* filename); //将大楼信息从文件中读取 friend ostream& operator<< (ostream &is, CBuilding & cb); ~CBuilding(); }; void main() { CBuilding Building; Building.ReadData("data.txt"); Building.AddHouse("507",23000,80); cout<<Building<<endl; } 该类中的所有成员函数在类的外部给予实现。 CHouse类对运算符 >>重载，实现从流中获取房屋信息。 CBuilding类的ReadData函数通过调用CHouse类的运算符 >>重载函数，实现房屋信息的加载。加载文本文件data.txt需要考生先在自己在当前文件夹下建立，

完整代码如下： #include #include using namespace std; #define N 3 class CHouse { ... Building.ReadData("data.txt");... Building.AddHouse("507", 23000, 80); cout << Building ; return 0; }

Error building SqlSession.

As an AI language model, I don't have access to the specific details of the error you encountered while building SqlSession. However, here are some possible reasons why you may have encountered this ...

bootstrap-table.min.js:10 Uncaught (in promise) TypeError: Cannot read properties of undefined (reading 'total') at e.value (bootstrap-table.min.js:10:96895) at HTMLTableElement.<anonymous> (bootstrap-table.min.js:10:113747) at Function.each (jquery.min.js:2:2976) at S.fn.init.each (jquery.min.js:2:1454) at t.fn.bootstrapTable (bootstrap-table.min.js:10:113507) at building.js:33:33 value @ bootstrap-table.min.js:10 (anonymous) @ bootstrap-table.min.js:10 each @ jquery.min.js:2 each @ jquery.min.js:2 t.fn.bootstrapTable @ bootstrap-table.min.js:10 (anonymous) @ building.js:33 Promise.then (async) searchbuilding @ building.js:31 invokeWithErrorHandling @ vue.js:3700 invoker @ vue.js:1529 original_1._wrapper @ vue.js:8013

这个错误提示是在使用bootstrap-table时出现的。具体来说是在调用bootstrap-table的value函数时出现了错误，因为value函数要使用一个undefined的属性'total'，导致了TypeError。建议检查代码，看看是否正确地使用了...

用python写楼房管理代码 1.添加房屋信息 2.删除房屋信息 3.更新房屋信息 4.查找房屋信息 5.按价格从高到低输出各个楼房的信息

building.add_house(House(2, 'address2', 200)) building.add_house(House(3, 'address3', 150)) # 查找房屋信息 house = building.find_house(2) if house: print(f'找到房屋：{house.address}, 价格：{...

You are given a map of a building made up of n×m squares, and each square is either a floor or a wall. Find how many rooms are in the building. A room is defined by a group of any number of adjacently connected floor squares, that is surrounded by walls. Input The first input line has two integers n and m: the height and width of the map. Then there are n lines each containing m characters describing the map. Each character is either . (floor) or # (wall). Output Print one integer, the number of rooms. Constraints 1≤n,m≤1000 Sample Input: 5 8 ######## #..#...# ####.#.# #..#...# ######## Output: 3

building.assign(n, vector(m)); for (int i = 0; i ; i++) { for (int j = 0; j ; j++) { cin >> building[i][j]; } } int roomCount = countRooms(); cout ; return 0; } ``` You can compile and run...

jenkin sh 中有多个命令

- `echo "building..."`：输出"building..."字符串。 - `mvn clean package`：使用Maven进行项目构建。 - `echo "build finished."`：输出"build finished."字符串。这三个命令顺序执行，如果其中有一个失败，整个...

Duplicate class found in the file 'C:\Users\王宇\IdeaProjects\DBM2\src\jdbc\util\building.java'

在给定的引用中，提到了在复制Java文件或Module时出现了"Duplicate class found in the file"的错误。这个错误通常是由于重复的类定义导致的。为了解决这个问题，你可以尝试以下方法： 1. 检查文件路径：确保你复制...

完善下列代码#define N 3; class CHouse { private: char mName[20]; //地址 float mPrice; //单价 float mArea; //面积 public: float getprice() { return mPrice; } float getarea() { return mArea; } void set(char* name, float price, float area); //修改房屋参数 CHouse(char* name=0,float price=0,float area=0); //构造函数 friend ifstream& operator>> (ifstream &is, CHouse &house); //从文件中读取一个房屋参数 friend ostream& operator<< (ostream &is, CHouse &house); }; class CBuilding //大楼 { private: CHouse mHouse; int mNums; int size; public: CBuilding(int m = N) { mHouse = new CHouse[m]; size = m; mNums = 0; } float Total(); //计算大楼所有房屋的总价值 void AddHouse(char name,float price,float area); //加入房屋到大楼中,注意空间是否超出 void ReadData(char* filename); //将大楼信息从文件中读取 friend ostream& operator<< (ostream &is, CBuilding & cb); ~CBuilding(); }; void main() { CBuilding Building; Building.ReadData("data.txt"); Building.AddHouse("507",23000,80); cout<<Building<<endl; }

这段代码中存在一个问题：在宏定义 N 的后面有一个分号，应该将它改为： ``` #define N 3 ``` 另外，还需要完善 CHouse 类中的 set 方法和构造函数，代码如下：...CBuilding::~CBuilding() { delete[] mHouse; } ```

Reading package lists... Done Building dependency tree... Done Reading state information... Done E: Unable to locate package tracepath

2. Building dependency tree... Done：该步骤表示apt-get在构建软件依赖关系树，并完成了这个操作； 3. Reading state information... Done：该步骤表示apt-get在读取软件包状态信息，并完成了这个操作； 4. E: ...

严重性代码说明项目文件行禁止显示状态错误 Unity.IL2CPP.Building.BuilderFailedException: render_api_D3D11.cpp Il2CppOutputProject C:\TempProject\1.JN_total_project\test_dele_0606\Il2CppOutputProject\EXEC 1

看起来这是一个Unity.IL2CPP编译错误，通常是由于代码中存在语法错误或其他编译问题导致的。具体错误信息是“render_api_D3D11.cpp”，可能是与渲染API相关的代码出现问题。建议检查代码中的语法错误，并确认使用的...

ramissue

粉丝: 354
资源: 1487

上传资源快速赚钱

我的内容管理展开

我的资源快来上传第一个资源

我的收益

登录查看自己的收益

我的积分登录查看自己的积分

我的C币登录后查看C币余额

我的收藏

我的下载

下载帮助

保障用户安全：编写稳健PHP应用指南

Laravel Up and Running A Framework for Building Modern PHP Apps 无水印pdf

appsservphp开发

building.pck损坏

@MapperScan("com.building.*.*.mapper") 中 * 号的作用

用python爬取http://124.95.133.164/work/xjlp/new_building.jsp

用python爬取http://124.95.133.164/work/xjlp/new_building.jsp最里层数据

python爬取网页http://124.95.133.164/work/xjlp/new_building.jsp的数据并写入Excel

用python爬取网页http://124.95.133.164/work/xjlp/new_building.jsp到表格

爬取这个网站所有文本和表格，http://124.95.133.164/work/xjlp/new_building.jsp?page=1

请解释以下代码：wrapper.join(Building.class, Building::getBuildingNo, Room::getBuildingNo)

Error building SqlSession.

用python写楼房管理代码 1.添加房屋信息 2.删除房屋信息 3.更新房屋信息 4.查找房屋信息 5.按价格从高到低输出各个楼房的信息

jenkin sh 中有多个命令

Duplicate class found in the file 'C:\Users\王宇\IdeaProjects\DBM2\src\jdbc\util\building.java'

Reading package lists... Done Building dependency tree... Done Reading state information... Done E: Unable to locate package tracepath

严重性 代码 说明 项目 文件 行 禁止显示状态 错误 Unity.IL2CPP.Building.BuilderFailedException: render_api_D3D11.cpp Il2CppOutputProject C:\TempProject\1.JN_total_project\test_dele_0606\Il2CppOutputProject\EXEC 1

最新资源

@MapperScan("com.building...mapper") 中 * 号的作用

严重性代码说明项目文件行禁止显示状态错误 Unity.IL2CPP.Building.BuilderFailedException: render_api_D3D11.cpp Il2CppOutputProject C:\TempProject\1.JN_total_project\test_dele_0606\Il2CppOutputProject\EXEC 1