Shulou(Shulou.com)06/03 Report--

This article will explain in detail about php security problems in the:Null character example analysis, Xiaobian think quite practical, so share to you as a reference, I hope you can read this article after harvest.

Because PHP's file system operations are based on C language functions, it can handle Null characters in ways you might not expect. The Null character is used in C to identify the end of a string, a complete string from its beginning until it meets the Null character. The following code demonstrates a similar attack:

Example #1 Code that can be attacked by Null character problem

The code is as follows:

Therefore, any string used to manipulate the file system must be properly checked. Here is an improved version of the above example:

Example #2 Correct way to verify input

The code is as follows:

A single functional error could expose databases being used by the system or provide an attacker with useful information about web pages, programs, or designs. Attackers will often find open database ports, as well as certain bugs or weaknesses on the page. For example, an attacker could bug a program with some data anomaly to detect the sequence of authentication in the script (via error line numbers) and information that might be leaked elsewhere in the script.

A file system or PHP error reveals what permissions the web server has and how files are organized on the server. The developer's own error code exacerbates this problem, causing hidden information to leak.

There are three common ways to deal with these problems. The first is to thoroughly examine all functions and try to fix most errors. The second is to completely shut down error reporting for online systems. The third is to create your own error-handling mechanism using PHP's custom error-handling functions. Depending on the security policy, all three methods may apply.

About "php security problems:Null character example analysis" This article is shared here, I hope the above content can be of some help to everyone, so that you can learn more knowledge, if you think the article is good, please share it to let more people see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.