PHP´óÉñµÄÊ®´óÓÅÁ¼Ï°¹ß

php´oÉñÑø³É¼Ç£¬¾ßÌaÄÚÈÝÈçÏÂ

1¡¢¶aÔĶÁÊÖ²aºÍÔ´´uÂe

ûʲô±ÈÔĶÁÊÖ²a¸uÖµµÃÇ¿µ÷µÄÊÂÁ˨C½o½oͨ¹ýÔĶÁÊÖ²aÄa¾Í¿ÉÒÔѧϰµ½ºÜ¶a¶«Î÷£¬ÌرðÊǺܶaÓйØÓÚ×Öu´®ºÍÊý×eµÄº¯Êý¡£¾ÍÔÚÕaÐ(C)º¯ÊýÀiÃae°uÀ¨Ði¶aÓÐÓõŦÄÜ£¬Èç¹uÄa×ÐϸÔĶÁÊÖ²a£¬Äa»a¾­³£¢ÏÖÔÚÒÔÍuµÄÏiÄ¿¿ª¢¹ý³ÌÖУ¬ºÜ¶aʱºoÄaÔÚ¡°Öظ´¢Ã÷ÂÖ×Ó¡±£¬¶øʵ¼ÊÉÏÄaÖ»ÐeÒªÒ»¸oºËÐĺ¯Êý¾Í¿ÉÒÔÍe³ÉÏaÓ¦µÄ¹¦ÄÜ¡£ÊÖ²aÊÇÄaµÄÅoÓÑ¡£ÁiÍa£¬ÏÖÔÚÓкܶaʹÓÃPHP¿ª¢µÄ¿ªÔ´³ÌÐo¡£ÎªÊ²Ã´²»È¥Ñ§Ï°ºÍ½e¼øÄØ£¿ÏÂÔØһݿªÔ´µÄPHPÓ¦ÓóÌÐoµÄÔ´´uÂe£¬×ÐϸÔĶÁËu°É¡£Ò²ÐiÔ½´oµÄÏiÄ¿Ô½ÖµµÃÈ¥ÔĶÁ£¬ËaÈ»ËuÃÇÒ²ÐiÓиu¸´ÔӵĽa¹¹ºÍϵͳ£¬µ«Ò²ÓиuÏeϸµÄ½aÊÍÎĵµ¡£

2¡¢±aдģ¿e»¯´uÂe

Á¼ºÃµÄPHP´uÂeÓ¦¸ÃÊÇÄ£¿e»¯µÄ´uÂe¡£PHPµÄÃaeÏo¶ÔÏoµÄ±a³Ì¹¦ÄÜÊÇÒ»Ð(C)ÌرðÇ¿´oµÄ¹¤¾ß£¬¿ÉÒÔ°ÑÄaµÄÓ¦ÓóÌÐoÖ½a³Éº¯Êý»o½¨¡£ÄaÓ¦¸Ã¾¡¿ÉÄܶaµÄ´ÓÄaµÄÓ¦ÓóÌÐoµÄþÎñÆ÷¶Ë*Ö¿ªÇ°¶ËµÄHTML/CSS/JavaScript´uÂe£¬ÄaÒ²¿ÉÒÔÔÚÈκÎPHP¿o¼ÜÉÏ×ñÑ­MVC£¨Ä£ÐÍ-ÊÓͼ-¿ØÖÆÆ÷£(C)ģʽ¡£

*3¡¢´uÂe±aд¹ae¶
**

Á¼ºÃµÄPHP´uÂeÓ¦¸ÃÓÐÒ»Ì×ÍeÕuµÄ´uÂe±aд¹ae¶¡£Í¨¹ý¶Ô±aÁ¿ºÍº¯ÊýµÄÃuÃu£¬Í³Ò»µÄ½¨ÃÎÊÊý¾Ý¿aºÍ¶Ô´iÎoµÄ´¦Ài£¬ÒÔ¼°Í¬ÑuµÄ´uÂeËo½ø½Ê½µÈÀ´´iµ½±a³Ì¹ae¶£¬ÕaÑu¿ÉÒÔʹÄaµÄ´uÂe¸u¾ß¿É¶ÁÐÔ¡£

4¡¢±aд¿ÉÒÆÖ²´uÂe

Á¼ºÃµÄPHP´uÂeÓ¦¸ÃÊÇ¿ÉÒÆÖ²µÄ¡£Äa¿ÉÒÔʹÓÃphpµÄÏÖÓй¦ÄÜ£¬ÈçħÊoÒýºÅºÍ¶Ì±eÇ(C)¡£ÊÔ×ÅÁ˽aÄaµÄÐeÇo£¬È»ºoͨ¹ýÊÊÓ¦PHPÌØÐÔÀ´±aд´uÂeÈôuÂe¶ÀÁ¢¡¢¿ÉÒÆÖ²¡£

5¡¢±aд°²È«´uÂe

Á¼ºÃµÄPHP´uÂeÓ¦¸ÃÊÇ°²È«µÄ¡£PHP5Ìa¹(C)Á˳oÉ«µÄÐÔÄܺÍÁe»iÐÔ¡£µ«ÊÇ°²È«ÎÊÌaÍeÈ«ÔÚÓÚ¿ª¢ÈËÔ±¡£¶ÔÓÚÒ»¸oרҵµÄPHP¿ª¢ÈËÔ±À´Ëµ£¬ÉiÈeÀi½aÖØ´o°²È«Â(C)¶´ÊÇÖÁ¹ØÖØÒªµÄ£¬È磺¿çÕ¾µa½Å±¾(XSS)¡¢¿çÕ¾ÇeÇoαÔi(CSRF)¡¢´uÂe×¢ÈeÂ(C)¶´¡¢×Ö*u±aÂeÂ(C)¶´¡£Í¨¹ýʹÓÃPHPµÄÌØÊa¹¦Äܺͺ¯Êý£¬È磺mysql_real_escape_stringµÈµÈ£¬Äa¿ÉÒÔ±aд³o°²È«µÄ´uÂe¡£

6¡¢´uÂe×¢ÊÍ

´uÂe×¢ÊÍÊÇ´uÂeµÄÖØÒª×e³É²¿Ö¡£Í¨¹ý´uÂe×¢ÊÍ¿ÉÒÔÖªµÀ¸Ã±aÁ¿»oº¯ÊýÊÇ×oʲôµÄ£¬Õa½«ÔÚ½ñºoµÄ´uÂeά»¤ÖÐÊ®ÖÓÐÓá£

7¡¢Ê¹Óõ¥ÒýºÅ´uÌaeË«ÒýºÅ

×Öu´®Ê¼ÖÕʹÓõ¥ÒýºÅ´uÌaeË«ÒýºÅ£¬ÒÔ±ÜÃaPHPËÑË÷×Öu´®ÄڵıaÁ¿µ¼ÖµÄÐÔÄÜϽµ¡£Óõ¥ÒýºÅ´uÌaeË«ÒýºÅÀ´°uº¬×Öu´®£¬ÕaÑu×o»a¸u¿iÒ»Ð(C)¡£ÒoΪPHP»aÔÚË«ÒýºÅ°uΧµÄ×Öu´®ÖÐËÑÑ°±aÁ¿£¬µ¥ÒýºÅÔo²»»a

*8¡¢×ªÒa×Öu´®Êa³o
**

ʹÓÃENT_QUOTES×÷²ÎÊý´«µÝ¸øhtmlspecialcharsº¯Êý£¬ÒÔÈ*±£µ¥ÒýºÅ(¡®)Ҳת»»³ÉHTMLʵÌa£¬ÕaÊÇÒ»¸oºÃÏ°¹ß¡£

9¡¢Ê¹ÓöººÅÖ¸o×Öu´®Êa³o

ͨ¹ýechoÓi¾aÊa³oʹÓöººÅ(,)Ö¸oµÄ×Öu´®£¬Òª±ÈʹÓÃ×Öu´®Á¬½Ó²Ù×÷u(.)µÄÐÔÄܸuºÃ¡£

10¡¢Êa³oÇ°¼i²e´«À´µÄÖµ

Êa³oÇ°¼i²e´«¹ýÀ´µÄÖµ$_GET[¡®query']¡£Ê¹ÓÃisset»oemptyº¯Êý£¬¿ÉÒÔÓÃÀ´¼i²e±aÁ¿ÊÇ*ñΪnullÖµ¡£

ÒÔÉϾÍÊDZ¾ÎĵÄÈ«²¿ÄÚÈÝ£¬Ï£Íu¶Ô´o¼ÒµÄѧϰÓÐËu°iÖu£¬Ò²Ï£Íu´o¼Ò¶a¶aÖ§³Ö½Å±¾Ö®¼Ò¡£