没有合适的资源?快使用搜索试试~ 我知道了~
首页保障用户安全:编写稳健PHP应用指南
"《构建安全的PHP应用》是一本由Ben Edmunds撰写的实用手册,旨在帮助开发者确保他们的PHP应用程序免受黑客攻击,保护用户敏感数据的安全。书中针对初学者到专业人士,提供了清晰、可操作的指导,涵盖了以下关键主题: 1. 永不信任用户:所有输入都要进行转义 - 作者强调了在处理用户输入时的重要性,防止SQL注入攻击,确保代码对恶意输入具有防御性。 2. HTTPS/SSL/加密技术 - 提供了关于使用安全套接字层(SSL)和不同加密算法(如BCA、JWH和SHA)的深入解释,这些技术对于保护数据传输至关重要。 3. 密码加密与存储 - 教授如何正确地加密和存储用户的密码,以防止数据泄露,确保密码安全。 4. 身份验证、访问控制与安全文件操作 - 涵盖了如何实现有效的身份验证机制,以及如何实施访问控制,避免恶意文件操作。 5. 安全默认设置、跨站脚本攻击及其他常见漏洞 - 提醒开发者注意常见的安全陷阱,如跨站脚本(XSS)攻击,并提供防范策略。 作为一本 Leanpub 出版的书籍,它是一个持续更新的过程,作者鼓励读者参与反馈,共同改进内容。书中的示例代码全部采用PHP编写,并可在GitHub上获取源代码。《构建安全的PHP应用》不仅适合初学者学习基础安全实践,也适合经验丰富的开发人员提升现有项目的安全性。 通过阅读这本书,开发者可以增强自己应用的安全性,减少数据丢失的风险,确保用户信息的安全,从而提高整体系统的可靠性。这是一本可以帮助开发者提升技能、保障网络安全的实用指南,让每一个PHP应用都能让用户安心使用,开发者无后顾之忧。"
资源详情
资源推荐
![](https://csdnimg.cn/release/download_crawler_static/9185715/bg10.jpg)
Chapter 1 - Never Trust Your Users. Sanitize ALL Input! 11
1 <form action="...">
2 <input type="text" name="first_name" />
3 <input type="text" name="last_name" />
4 <input type="text" name="email" />
5 <input type="hidden" name="permissions" value="{\
6 'admin':'true'}" />
7 </form>
That same code would now change this user’s permissions
erroneously.
This may sound like a dumb problem to solve, but it is one
that a lot of developers and sites have fallen victim to. The
most recent, well-known exploit of this vulnerability was
when a user exposed that Ruby on Rails was susceptible to
this. When Egor Homakov originally reported to the Rails
team that new Rails installs were insecure, his bug report
was rejected. The core team thought it was a minor concern
that would be easier for new developers to leave enabled by
default. To get attention to this issue, Homakov hilariously
“hacked” Rails’ GitHub account (GitHub is built on Rails)
to give himself administrative rights to their repositories.
Needless to say, this proved his point, and now Rails (and
GitHub) are protected from this attack by default.
How do you protect your application against this? The exact
implementation details depend on which framework or code
base you’re using, but you have a few options:
• Turn off mass assignment completely
• Whitelist the fields that are safe to be mass assigned
• Blacklist the fields that are not safe to be mass assigned
![](https://csdnimg.cn/release/download_crawler_static/9185715/bg11.jpg)
Chapter 1 - Never Trust Your Users. Sanitize ALL Input! 12
Depending on your implementation, some of these may be
used simultaneously.
In Laravel you add a $fillable property to your models to
set the whitelist of fields that are mass assignable:
1 class User extends Eloquent {
2
3 protected $table = 'users';
4
5 protected $fillable = ['first_name', 'last_name'\
6 , 'email'];
This would stop the “permissions” column from being mass
assigned. Another way to handle this in Laravel is to set a
blacklist with the $guarded property:
1 class User extends Eloquent {
2
3 protected $table = 'users';
4
5 protected $guarded = ['permissions'];
The choice is up to you, depending on which is easier in your
application.
If you don’t use Laravel, your framework probably has a
similar method of whitelisting/blacklisting mass assignable
fields. If you use a custom framework, get on implementing
whitelists and blacklists!
![](https://csdnimg.cn/release/download_crawler_static/9185715/bg12.jpg)
Chapter 1 - Never Trust Your Users. Sanitize ALL Input! 13
Typecasting
One additional step I like to take, not just for security but also
for data integrity, is to typecast known formats. Since PHP is a
dynamically typed language⁸, a value can be any type: string,
integer, float, etc. By typecasting the value, we can verify that
the data matches what we expect. In the previous example,
if the ID was coming from a variable it would make sense to
typecast it if we knew it should always be an integer, like this:
1 $id = (int) 1001;
2
3 $db = new PDO(...);
4 $query = $db->prepare('UPDATE users
5 SET first_name = :first_name
6 WHERE id = :id');
7
8 $query->execute([
9 ':id' => $id, //we know its an int
10 ':first_name' => $_POST['first_name']
11 ]);
In this case it wouldn’t matter much since we are defining
the ID ourselves, so we know its an integer. But if the ID
came from a posted form or another source, this would give
us additional peace of mind.
PHP supports a number of types that you can cast to, they are
⁸http://stackoverflow.com/questions/7394711/what-is-dynamic-typing
![](https://csdnimg.cn/release/download_crawler_static/9185715/bg13.jpg)
Chapter 1 - Never Trust Your Users. Sanitize ALL Input! 14
1 $var = (array) $var;
2 $var = (binary) $var;
3 $var = (bool) $var;
4 $var = (boolean) $var;
5 $var = (double) $var;
6 $var = (float) $var;
7 $var = (int) $var;
8 $var = (integer) $var;
9 $var = (object) $var;
10 $var = (real) $var;
11 $var = (string) $var;
This is helpful not only when dealing with your database, but
throughout your application. Just because PHP is dynamically
typed doesn’t mean that you can’t enforce typing in certain
places. Yeah science!
![](https://csdnimg.cn/release/download_crawler_static/9185715/bg14.jpg)
Chapter 1 - Never Trust Your Users. Sanitize ALL Input! 15
Sanitizing Output
Outputting to the Browser
Not only should you take precautions when saving the data
you take in, you should sanitize / escape any user-generated
data that is output back to the browser.
You can modify and escape your data prior to saving to the
database, or in between retrieving it and outputting to the
browser. It usually depends on how your data is edited and
used. For example, if the user is editing the data later, it
usually makes more sense to save it as-is, and sanitize upon
output.
What security benefits come from escaping user-generated
data that you output? Suppose a user submits the following
JavaScript snippet to your application, which saves it for
outputting later:
<script>alert('I am not sanitized!');</script>
If you don’t sanitize this code before you echo it out to the
browser, the malicious JavaScript will run normally, as if you
wrote it yourself. In this case it’s a harmless alert(), but a
hacker won’t be nearly as kind.
Another popular place for this type of exploit is in an image’s
XIFF data. If a user uploads an image and your application
displays the XIFF data, it will need to be sanitized as well.
Anywhere you are displaying data that came into your app
from the outside, you need to sanitize it.
If you’re using a templating library or a framework that
handles templating, escaping may happen automatically, or
剩余101页未读,继续阅读
![pdf](https://img-home.csdnimg.cn/images/20210720083512.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://profile-avatar.csdnimg.cn/e66324aa22894c0997bffffafc974f36_ramissue.jpg!1)
ramissue
- 粉丝: 354
- 资源: 1487
上传资源 快速赚钱
我的内容管理 展开
我的资源 快来上传第一个资源
我的收益
登录查看自己的收益我的积分 登录查看自己的积分
我的C币 登录后查看C币余额
我的收藏
我的下载
下载帮助
![](https://csdnimg.cn/release/wenkucmsfe/public/img/voice.245cc511.png)
最新资源
- 解决Eclipse配置与导入Java工程常见问题
- 真空发生器:工作原理与抽吸性能分析
- 爱立信RBS6201开站流程详解
- 电脑开机声音解析:故障诊断指南
- JAVA实现贪吃蛇游戏
- 模糊神经网络实现与自学习能力探索
- PID型模糊神经网络控制器设计与学习算法
- 模糊神经网络在自适应PID控制器中的应用
- C++实现的学生成绩管理系统设计
- 802.1D STP 实现与优化:二层交换机中的生成树协议
- 解决Windows无法完成SD卡格式化的九种方法
- 软件测试方法:Beta与Alpha测试详解
- 软件测试周期详解:从需求分析到维护测试
- CMMI模型详解:软件企业能力提升的关键
- 移动Web开发框架选择:jQueryMobile、jQTouch、SenchaTouch对比
- Java程序设计试题与复习指南
资源上传下载、课程学习等过程中有任何疑问或建议,欢迎提出宝贵意见哦~我们会及时处理!
点击此处反馈
![](https://img-home.csdnimg.cn/images/20220527035711.png)
![](https://img-home.csdnimg.cn/images/20220527035711.png)
![](https://img-home.csdnimg.cn/images/20220527035111.png)
安全验证
文档复制为VIP权益,开通VIP直接复制
![](https://csdnimg.cn/release/wenkucmsfe/public/img/green-success.6a4acb44.png)