PHP 中巧用数组降低程序的时间复杂度
OpenX adserver version 2.8.1 and lower is vulnerable to remote code
execution. To be exploited, this vulnerability requires banner / file
upload permissions, such as granted to the 'advertiser' and
'administrator' roles.
This vulnerability is caused by the (insecure) file upload mechanism of
affected OpenX versions. These would check magic bytes of an uploaded
file to determine its MIME type, and erroneously assume this
information to be reliable. Additionally, while the file name of
uploaded files is changed, the file extension is not.
As such, it is possible to upload image files with embedded PHP code and
.php file extension. Unless PHP script execution is explicitly prevented
for the file upload location (which has not been documented in the OpenX
manual so far and it is not the result of a default installation), the
PHP code will execute as soon as HTTP access to the file location will
cause it to be executed by the web server.
To clarify, an attacker exploiting this security issue does require
prior access to OpenX, i.e. exploitation is only possible after
successful authentication. On the other hand, advertiser access is a
rather low permission level and should not allow for system access.
If these bugs were not hidden from OpenX' bug tracker, you could read up
more about issue X-5747 here:
https://developer.openx.org/jira/browse/OX/fixforversion/10910
OpenX 2.8.2 has already been released in October to fix this issue and
can be downloaded from Roll forming machine
http://www.openx.org/ad-server/download
Moritz Naumann
Naumann IT Security Consulting
Berlin, Germany
http://www.moritz-naumann.com/
相关文档：
1、用PHP打印出前一天的时间格式是2006-5-10 22:21:21(2分)
2、echo(),print(),print_r()的区别(3分)
3、能够使HTML和PHP分离开使用的模板(1分)
4、使用哪些工具进行版本控制?(1分)
5、如何实现字符串翻转?(3分)
--------------------------------------------------------------- ......
cookie默认不能存数组，所以下面的写法是错误的。
<?php
$arr = array(1,2,3);
setcookie('a',$arr);
$arr = array(1,2,3);
setcookie('a',$arr);
?>
报错如下：
Warning: setcookie() expects parameter 2 to be string, array given in
但是PHP可以把同名且后面以[]结尾的cookie解析为数组。在 ......
1.如果一个方法可静态化，就对它做静态声明。速率可提升至4倍。
2.echo 比 print 快。
3.使用echo的多重参数（译注：指用逗号而不是句点）代替字符串连接。
4.在执行for循环之前确定最大循环数，不要每循环一次都计算最大值。
5.注销那些不用的变量尤其是大数组，以便释放内存。
6.尽量避免使用__get，__se ......
一直都以为在PHP中，' 和"是没有区别的，今天看了中原大学孙仲岳老师的视频教程，才发现，这两者用法是有区别的，举个简单的例子：
1.php
<?$str='冰冻鱼';
echo '$str 的博客地址是http://www.webxuexi.net' ;//注意这里是单引号哦
?>
2.php
<?
$str='冰冻鱼';
echo ......
