Shulou(Shulou.com)06/02 Report--

In this issue, the editor will bring you about the implementation and security of HTTPS. The article is rich in content and analyzes and narrates it from a professional point of view. I hope you can get something after reading this article.

HTTPS definition

The full name of HTTPS is Secure Hypertext Transfer Protocol (secure Hypertext transfer Protocol), which adds the use of SSL encryption transport protocol to the http protocol.

Realization process

Use OPENSSL to create example.key (private key) and example.crt (certificate signing request file) on the server

Provide the CSR file to the CA institution. After the signature is successful, you will get the example.crt certificate file. After the SSL certificate file is obtained, you can configure HTTPS in the Nginx configuration file.

The difference of the relationship between socket http tcp udp

Tcp udp belongs to the transport layer protocol

Http belongs to the application layer protocol

Socket is an API encapsulated by tcp udp protocol.

The difference between tcp and udp

Tcp is stable, reliable, and slow: there is a three-way handshake to establish a connection.

Udp is unstable, unreliable, and fast: without TCP's handshake, UDP is a stateless transport protocol, so it passes data very fast.

SQL injection protection in security

Addslashes ():'"can be escaped, but there is a" wide byte injection "vulnerability, which is abandoned.

Mysql_real_escape_string (): can effectively solve the injection vulnerability of PHP in the assembly of sql statements.

Preprocessing query (Prepared Statements): first pre-send a sql template to mysql, and then send parameters to mysql for injection processing

Type 3 method is recommended, and many frameworks use this method by default!

XSS (cross-site scripting attack) protection

Deceive users by submitting JavaScript scripts / iframe to the form to eavesdrop on cookie, phishing websites, etc.

Htmlspecialchars (): recommended, convert > to & gt;

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.