Shulou(Shulou.com)06/03 Report--

This article introduces the relevant knowledge of "what are the methods of making PHP websites with high security". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

Tip 1: use appropriate error reporting

Generally speaking, in the process of development, many programmers always forget to make program error reports, which is a big mistake, because proper error reporting is not only the best debugging tool, but also an excellent security vulnerability detection tool. this allows you to find out as much as possible the problems you will encounter before you actually put the application online.

Of course, there are many ways to enable error reporting. For example, in the php.in configuration file, you can set it to be enabled at run time

Start error reporting

Error_reporting (E_ALL)

Deactivate error reporting

Error_reporting (0)

Tip 2: do not use the Weak attribute of PHP

There are several PHP properties that need to be set to OFF. They are generally found in PHP4, but they are not recommended in PHP5. Especially in the end, in PHP6, these attributes are removed.

Register global variables

When register_globals is set to ON, it is equivalent to setting Environment,GET,POST,COOKIE or Server variables to be defined as global variables. At this point, you don't need to write $_ POST ['username'] to get the form variable' username',. You just need'$username''to get it.

So you must be thinking, if setting register_globals to ON has such a convenient benefit, why not use it? Because if you do this, it will cause a lot of security problems, and it may also conflict with local variable names.

For example, take a look at the following code:

The copy code is as follows:

If (! empty ($_ POST ['username']) & & $_ POST [' username'] = = 'test123' & &! empty ($_ POST [' password']) & & $_ POST ['password'] = = "pass123")

{

$access = true

}

If register_globals is set to ON at run time, the user only needs to transfer access=1 in a query string to get anything that the PHP script runs.

Deactivate global variables in .htaccess

The copy code is as follows:

Php_flag register_globals 0

Deactivate global variables in php.ini

The copy code is as follows:

Register_globals = Off

Deactivate Magic Quotes such as magic_quotes_gpc, magic_quotes_runtime, magic_quotes_sybase

Set in the .htaccess file

The copy code is as follows:

Php_flag magic_quotes_gpc 0

Php_flag magic_quotes_runtime 0

Set up in php.ini

The copy code is as follows:

Magic_quotes_gpc = Off

Magic_quotes_runtime = Off

Magic_quotes_sybase = Off

Tip 3: validate user input

Of course, you can also validate the user's input. You must first know the type of data you expect the user to enter. In this way, you can be prepared on the browser side against malicious attacks from users.

Tip 4: avoid cross-site scripting attacks by users

In Web applications, users simply accept input forms and then give feedback on the results. When accepting user input, it would be very dangerous to allow input in HTML format, because this also allows JavaScript to invade in an unexpected way and execute directly. Even if there is such a loophole, cookie data may be stolen, resulting in the theft of users' accounts.

Tip 5: prevent SQL injection attacks

PHP basically doesn't provide any tools to protect your database, so when you connect to the database, you can use the following mysqli_real_escape_string function.

The copy code is as follows:

$username = mysqli_real_escape_string ($GET ['username'])

Mysql_query ("SELECT * FROM tbl_employee WHERE username ='". $username. "'")

This is the end of the content of "what are the ways to make a highly secure PHP website". Thank you for reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.