HTTP Only cookies without PHP 5.2
HTTP Only cookies without PHP 5.2
by Matt Mecham
on September 12, 2006
For a while, Microsoft have had a flag
for cookies called ‘httponly’. This doesn’t sound particularly
exciting, but it is a vital step forward for web application security.
This flag tells Internet Explorer to make this cookie ‘invisible’ to
javascript (and other scripting languages) which means that an XSS
attack will no longer be able to steal your sensitive cookies.
The problem is that ‘http only’ support has only just been added into PHP 5.2
. This makes this feature unavailable to most webservers.
However, there appears to be a way to force this flag to be written
regardless of your PHP version by simply adding “; HttpOnly” at the end
of the domain name when setting the cookie. PHP’s “setcookie” function
merely formats the data into a “set-cookie” header. Fortunately, PHP
doesn’t appear to filter out or escape the semi-colon so it’s added to
the end of the “set-cookie” request.
if ( PHP_VERSION < 5.2 )
{
@setcookie( $name, $value, $expires, $path, $domain. '; HttpOnly' );
}
else
{
@setcookie( $name, $value, $expires, $path, $domain, NULL, TRUE );
}
I've tested this out and it appears to work fine. IE7 shows the
"sensitive" cookie data in the document.cookie string without adding
the flag. Adding the flag onto the domain string causes the sensitive
cookies to disappear from the document.cookie string.
Firefox ignores it and sets cookies as does Safari and Opera. I'll
do some more testing and report in on my findings. I also have a
Firefox friendly version to stop access to the document.cookie which
I'll post up tomorrow.
UPDATE 14th September
I've downloaded the source to PHP 5 to make confirm that this 'hack'
will work across different platforms. The source code confirms that no
cleaning takes place on
相关文档：
我们的电话报名系统中，呼叫中心收集了用户的银行信息，然后请求银行的支付接口的webservice，需要进行超时设置，因为不能一直让学员等待
解决方法是
1:首先先要看一下php.ini里的默认超时时间，一般是120秒
2：在php代码里加上
ini_set('default_socket_timeout', 10);//设置超时时间
如下图
......
1. PHP的COOKIE
cookie 是一种在远程浏览器端储存数据并以此来跟踪和识别用户的机制。
PHP在http协议的头信息里发送cookie, 因此 setcookie() 函数必须在其它信息被输出到浏览器前调用，这和对 header() 函数的限制类似。
1.1 设置cookie:
可以 ......
<?php
/**
* 改变图片的宽高
*
* @author flynetcn (2009-12-16)
*
* @param string $img_src 原图片的存放地址或url
* @param string $new_img_path 新图片的存放地址
* @param int $new_width 新图片的宽度
* @param int $new_height 新图片的高度
* @return bool 成功true, 失败false
* ......
<?php
//新建目录
mkdir("/path/to/my/dir", 0700); //0700表示权限最大
//删除目录
rmdir("/path/to/my/dir");
//遍历目录
$p =dir(/etc/php5);
echo "handler:".$p->handler;
while(false!=$entry=$p->read()){
echo $entry."\n" ;
}
$p->close();
//输出文件内容
$handle=@ ......
tidy 是一个非常帮忙的网页代码分析和纠错的工具，能够支持多种页面编码，并且支持xhtml输出。如果我们偷懒，甚至可以将整个页面缓存，最后采用tidy处理，最后输出完美的xhtml代码。
linux下安装过程如下：
首先安装tidy ，下载tidy源代码：
cvs -d:pserver: anonymous@tidy.cvs.sourceforge.net 为防备电子邮件地址收集 ......
