Ò׽ؽØÍ¼Èí¼þ¡¢µ¥Îļþ¡¢Ãâ°²×°¡¢´¿ÂÌÉ«¡¢½ö160KB

PHP³õѧÕßÍ·Í´µÄÊ®ËĸöÎÊÌâ

1.Ò³ÃæÖ®¼äÎÞ·¨´«µÝ±äÁ¿
get,post,sessionÔÚ×îеÄphp°æ±¾ÖÐ×Ô¶¯È«¾Ö±äÁ¿Êǹرյģ¬ËùÒÔÒª´ÓÉÏÒ»Ò³ÃæÈ¡µÃÌá½»¹ýÀ´µÃ±äÁ¿ÒªÊ¹ÓÃ$_GET['foo'],$_POST['foo'],$_SESSION['foo']À´µÃµ½¡£µ±È»Ò²¿ÉÒÔÐÞ¸Ä×Ô¶¯È«¾Ö±äÁ¿Îª¿ª(php.ini¸ÄΪregister_globals = On)£»¿¼Âǵ½¼æÈÝÐÔ£¬»¹ÊÇÇ¿ÆÈ×Ô¼ºÊìϤеÄд·¨±È½ÏºÃ¡£
 
2.Win32ÏÂapache2 ÓÃget·½·¨´«µÝÖÐÎIJÎÊý»á³ö´í
 ÀýÈ磺test.php?a=ÄãºÃ&b=ÄãÒ²ºÃ
´«µÝ²ÎÊýÊǻᵼÖÂÒ»¸öÄÚ²¿´íÎó
½â¾ö°ì·¨:"test.php?a=".urlencode(ÄãºÃ)."&b=".urlencode(ÄãÒ²ºÃ)
urlencode($myname)Ö÷ÒªÓÃÓÚÕýȷʶ±ðºº×Ö ¿Õ¸ñÒÔ¼°ÆäËûÌØÊâ×Ö·û¡£
 
3.win32ϵÄsession²»ÄÜÕý³£¹¤×÷
php.iniĬÈϵÄsession.save_path = /tmp  ÕâÏÔÈ»ÊÇlinuxϵÄÅäÖã¬win32ÏÂphpÎÞ·¨¶ÁдsessionÎļþµ¼ÖÂsessionÎÞ·¨Ê¹Ó㬰ÑËü¸Ä³ÉÒ»¸ö¾ø¶Ô·¾¶¾Í¿ÉÒÔÁË£¬ÀýÈçsession.save_path = c:windows emp ,Ò»°ãÕâ¸ö¹¤×÷ÔÚÅäÖÃphpÔÚwinµÄ°²×°»·¾³µÄʱºò¾ÍÓ¦¸Ã½â¾öµÄ¡£
 
4.ÏÔʾ´íÎóÐÅÏ¢
µ±php.iniµÄdisplay_errors = On²¢ÇÒerror_reporting = E_ALLʱ£¬½«ÏÔʾËùÓеĴíÎóºÍÌáʾ£¬µ÷ÊÔµÄʱºò×îºÃ´ò¿ªÒÔ±ã¾À´í¡£
 
5.¸ü¸Äphp.iniºóûÓб仯
Ò»°ãÒªÖØÆôÄãµÄWEB SERVER(apache IIS)¡£
 
6.header already sent
Õâ¸ö´íÎóͨ³£»áÔÚÄãʹÓÃHEADERµÄʱºò³öÏÖ£¬Ëû¿ÉÄÜÊǼ¸ÖÖÔ­Òò£º
        1,ÄãÔÚʹÓÃHEADERǰprint»òÕßechoÁË
        2.Ä㵱ǰÎļþÇ°ÃæÓпÕÐÐ
        3.Äã¿ÉÄÜINCLUDEÁËÒ»¸öÎļþ,
        4.¸ÃÎļþβ²¿ÓпÕÐлò  ÕßÊä³öÒ²»á³öÏÖÕâÖÖ´íÎó¡£
 
7.includeºÍrequireµÄÇø±ð 
1.include °üº¬Îļþ£¬Èç¹û¸ÃÎļþ²»´æÔÚ£¬Ëü»áÌáʾ,µ«ÊÇËü»á¼ÌÐøÍùÏÂÖ´ÐС£
2.require °üº¬Îļþ£¬Èç¹û¸ÄÎļþ²»´æÔÚ£¬»áÌáʾÖÂÃü´íÎ󣬲¢Í˳ö.
win32ƽ̨ÏÂËüÃǶ¼ÊÇÏȰüº¬ºóÖ´ÐС£
8.isset()ºÍempty()µÄÇø±ð
Ïàͬ£ºÁ½Õß¶¼ÊDzâÊÔ±äÁ¿ÓõÄ.
²»Í¬£ºisset()ÊDzâÊÔ±äÁ¿ÊÇ·ñ±»¸³Öµ
           empty()ÊDzâÊÔÒ»¸öÒѾ­±»¸³ÖµµÄ±äÁ¿ÊÇ·ñΪ¿Õ
Èç¹ûÒ»¸ö±äÁ¿Ã»±»¸³Öµ¾ÍÒýÓÃÔÚphpÀïÊDZ»ÔÊÐíµÄ,µ«»áÓÐnoticeÌáʾ£¬Èç¹ûÒ»¸ö±äÁ¿±»¸³¿ÕÖµ£¬$foo=""»òÕß$foo=0»òÕß $foo=false,ÄÇôempty($foo)·µ»ØÕ棬isset($foo)Ò²


Ïà¹ØÎĵµ£º

phpÓйصļ¸ÖÖ³£¼û°²È«Ïê½â

(1) ´ò¿ªphpµÄ°²È«Ä£Ê½
phpµÄ°²È«Ä£Ê½ÊǸö·Ç³£ÖØÒªµÄÄÚǶµÄ°²È«»úÖÆ£¬Äܹ»¿ØÖÆÒ»Ð©phpÖеĺ¯Êý£¬±ÈÈçsystem()£¬
ͬʱ°ÑºÜ¶àÎļþ²Ù×÷º¯Êý½øÐÐÁËȨÏÞ¿ØÖÆ£¬Ò²²»ÔÊÐí¶ÔijЩ¹Ø¼üÎļþµÄÎļþ£¬±ÈÈç/etc/passwd£¬
µ«ÊÇĬÈϵÄphp.iniÊÇûÓдò¿ª°²È«Ä£Ê½µÄ£¬ÎÒÃǰÑËü´ò¿ª£º
safe_mode = on
(2) Óû§×鰲ȫ
µ±safe_mode´ò¿ªÊ±£¬ ......

ÓÃPHP×ö¸öÈ˲ÅÕ¾

  ×î½üÓÐÈËÔÚÕбêÒª×ö¸öÏñ£ºwww.webjianzhi.com ÕâÑùµÄÈ˲ÅÕ¾£¬³õ¿´£¬Õâ¸öÍøÂç¼æÖ°Íø£¬½çÃæ»¹ÊDZȽÏÇåÎúµÄ¡£
 ÕûÌå·ÖÎöÁËһϣ¬Ò»¸öÐÂÎÅÎÄÕ·¢²¼ÏµÍ³£¬Õâ¸ö²»ÊǺÜÄÑ£¬ÁíÒ»¸ö¾ÍÊÇ×ֶε÷ÓÃϵͳ£¬¾ÍÊÇÊ×Ò³µÄÖ°Òµ½éÉÜ£¬¼æÖ°ÈËÆø£¬µÄÕâЩµ÷Óá£
 ÁíÒ»¸ö¾ÍÊÇ»áÔ±·¢²¼ÏµÍ³¡£
  Õû¸öÓñí¸ñ²¼¾Ö£¬ÃÀ¹¤Éϲ»´æÔ ......

PHPÎļþº¯Êý´óÈ«

ת×Ô http://wiki.kuaizhanbao.com/2009/1210/245.html
basename — ·µ»ØÂ·¾¶ÖеÄÎļþÃû²¿·Ö
chgrp — ¸Ä±äÎļþËùÊôµÄ×é
chmod — ¸Ä±äÎļþģʽ
chown — ¸Ä±äÎļþµÄËùÓÐÕß
clearstatcache — Çå³ýÎļþ״̬»º´æ
copy — ¿½±´Îļþ
delete — ²Î¼û unlink() »ò unset()
di ......

WinodwsÏÂIIS/Apache+PHP+MySQLµÄ°²×°ÅäÖÃ

ÎÒд¹ýµÄ½Ì³Ì²»¶à£¬¶øÇҴ󲿷ֶ¼ÊÇÀ´Ô´ÓÚ±ðÈ˵Ľ̳̣¬²»¹ý£¬ÕâÀïËù½éÉܵ쬶¼ÊÇÈÚÈëÎÒËù×ܽáµÄ¾­Ñ飮£­£­ÒýÑÔ
¡¡¡¡
¡¡¡¡PHPµÄÖ´ÐÐЧÂÊÊÇÓÐÄ¿¹²¶ÃµÄ£¬ÕâÒ²ÊÇÎÒϲ»¶ËüµÄÔ­ÒòÖ®Ò»£¬ºÍËü³ÆÎª¾øÃî´îµµµÄMysqlÒÔ¼°ApacheÏëÈںϣ¬²»Äܲ»¾ªÌ¾ÆäЧÂÊÁË¡£PHP¸üÐÂÒ²ºÜ¿ì£¬ÕâÀïÁоÙÁËĿǰ×îа汾PHP4.3.2RC4£¨¼¸ºõûÓÐBUGÁË£¬¹À¼ÆÐ´Í ......

ÖØÈ¼ÄãµÄPHP°²È«Ö®»ð

¶ÔÓڽű¾°²È«Õâ¸ö»°ÌâºÃÏñÓÀԶûÍêûÁË£¬Èç¹ûÄã¾­³£µ½¹úÍâµÄ¸÷ÖÖ¸÷ÑùµÄbugtraqÉÏ£¬Äã»á·¢ÏÖÓÐÒ»°ëÒÔÉ϶¼ºÍ½Å±¾Ïà¹Ø£¬ÖîÈçSQL
injection£¬XSS£¬Path Disclosure£¬Remote commands
executionÕâÑùµÄ×ÖÑ۱ȱȽÔÊÇ£¬ÎÒÃÇ¿´ÁËÖ®ºóµÄÓÃ;ÄѵÀ½ö½öÊÇ×¥È⼦?¶ÔÓÚÎÒÃÇÏë×öweb°²È«µÄÈËÀ´Ëµ£¬×îºÃ¾ÍÊÇÄÃÀ´Ñ§Ï°£¬¿ÉÊÇÍòÎï×¥¸ùÔ´£¬ÎÒà ......
© 2009 ej38.com All Rights Reserved. ¹ØÓÚE½¡ÍøÁªÏµÎÒÃÇ | Õ¾µãµØÍ¼ | ¸ÓICP±¸09004571ºÅ