php安全 过滤、验证、转义

不要相信外部源

• $_GET
• $_POST
• $_REQUEST
• $_COOKIE
• $argv
• php://stdin
• php://input
• file_get_contents()
• 远程数据库
• 远程api
• 来自客户端的数据

htmlentities

　　

<?php
$input = '<p><script>alert("You won the Nigerian lottery!");</script></p>';
echo htmlentities($input, ENT_QUOTES, 'UTF-8').PHP_EOL;
// &lt;p&gt;&lt;script&gt;alert(&quot;You won the Nigerian lottery!&quot;);&lt;/script&gt;&lt;/p&gt;

$email = 'john介样子@example.com';
$emailSafe = filter_var($email, FILTER_SANITIZE_EMAIL);
echo $emailSafe.PHP_EOL;
// john@example.com

$string = "
i18n说的话	";
$safeString = filter_var(
    $string,
    FILTER_SANITIZE_STRING,
    FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH
);
echo $safeString.PHP_EOL;
// i18n&#232;&#175;&#180;&#231;&#154;&#132;&#232;&#175;&#157;

// 转义输出
$output = '<p><script>alert("NSA backdoor installed")</script></p>';
echo htmlentities($output, ENT_QUOTES, 'UTF-8').PHP_EOL;
// &lt;p&gt;&lt;script&gt;alert(&quot;NSA backdoor installed&quot;)&lt;/script&gt;&lt;/p&gt;

　　

htmlpurifier

• aura/filter
• respect/validation
• symfony/validator

 模板引擎
　　

• twig/twig
• smarty/smarty

一些加密函数

md5, sha1, bcrypt, scrypt

* 注册用户

POST /register.php HTTP/1.1

Content-Length: 43

Content-Type: application/x-www-form-urlencoded

email=john@example.com&password=sekritshhh!

<?php
/**
 * Created by PhpStorm.
 * User: Mch
 * Date: 7/17/18
 * Time: 22:47
 */
try {
    // 验证电子邮箱地址
    $email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
    if (!$email) {
        throw new Exception('Invalid email');
    }
    // 验证密码
    $password = filter_input(INPUT_POST, 'password');
    if (!$password || mb_strlen($password) < 8) {
        throw new Exception('Password must contain 8+ characters');
    }
    // 创建密码的hash
    $passwordHash = password_hash($password, PASSWORD_DEFAULT, ['cost'=>12]);
    if ($passwordHash === false) {
        throw new Exception('Password hash failed');
    }
    // 创建用户账户(pseudo code)
    $user = new User();
    $user->email = $email;
    $user->pasword_hash = $passwordHash;
    $user->save();

    // 重定向到登录页面
    header('HTTP/1.1 302 Redirect');
    header('Location: /login.php');

} catch (Exception $e) {
    // 报告错误
    header('HTTP/1.1 400 Bad request');
    echo $e->getMessage();
}

<?php
/**
 * POST /login.php HTTP/1.1
 * Content-Length: 43
 * Content-Type: application/x-www-form-urlencoded
 *
 * email=john@example.com&password=sekritshhh!
 */
session_start();

try {
    $email = filter_input(INPUT_POST, 'email');
    $password = filter_input(INPUT_POST, 'password');

    // (pseudo code)
    $user = User::findByEmail($email);
    // 如果需要, 重新计算密码的hash值
    if (password_verify($password, $user->password_hash)===false) {
        throw new Exception('Invalid password');
    }

    // 如果需要, 重新计算密码的hash值
    $currentHashAlgorithm = PASSWORD_DEFAULT;
    $currentHashOptions = ['cost' => 15];
    $passwordNeedsRehash = password_needs_rehash(
        $user->password_hash,
        $currentHashAlgorithm,
        $currentHashOptions
    );
    if ($passwordNeedsRehash === true) {
        // 保存新计算得到的密码hash值 (pseudo code)
        $user->password_hash = password_hash(
            $password,
            $currentHashAlgorithm,
            $currentHashOptions
        );
        $user->save();
    }
    $_SESSION['user_logged_in'] = 'yes';
    $_SESSION['user_email'] = $email;

    // redirect
    header('HTTP/1.1 302 Redirect');
    header('Location: /user-profile.php');

} catch (Exception $e) {
    header('HTTP/1.1 401 Unauthorized');
    echo $e->getMessage();
}

emoji