PHP Security.ppt

文档介绍：PHPSecurityBy:sky1SecurityWhatisSecurity?Securityisameasurement,’’sabilitytopredictandpreventfuturesecurityproblems,,securitymustbeconsideredatalltimes;initialspec,implementation,&SecurityPHPkeepsongrowingasalanguage,&-,thereareaseriesofsuper-esstotheinputdata.$_GET–datafromgetrequests.$_POST–postrequestdata.$_COOKIE–cookieinformation.$_FILES–uploadedfiledata.$_SERVER–serverdata$_ENV–environmentvariables$binationofGET/POST/.?foo=bar>>$foo=“bar”;-initializedvariablescanbe“injected”(authenticated_user()){ $authorized=true;}if($authorized){ include'/highly/sensitive/';}Because$authorizedisleftun-initializedifuserauthenticationfails,essprivilegeddatabysimplypassingthevalueviaGET. /?authorized=-,($authorized===TRUE){?var[]=1&var[]=2Thelinkabovewillallowtheattackertoinjecttwovaluesint