mirror of
https://github.com/sigmasternchen/php-doc-en
synced 2025-03-15 16:38:54 +00:00
a42c9a9fd8
git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@283799 c90b9560-bf6c-de11-be94-00142212c4b1
103 lines
2.9 KiB
XML
103 lines
2.9 KiB
XML
<?xml version="1.0" encoding="iso-8859-1"?>
|
|
<!-- $Revision$ -->
|
|
<!-- splitted from ./index.xml, last change in rev 1.66 -->
|
|
<chapter xml:id="security.variables" xmlns="http://docbook.org/ns/docbook">
|
|
<title>User Submitted Data</title>
|
|
<para>
|
|
The greatest weakness in many PHP programs is not inherent in the
|
|
language itself, but merely an issue of code not being written with
|
|
security in mind. For this reason, you should always take the time
|
|
to consider the implications of a given piece of code, to ascertain
|
|
the possible damage if an unexpected variable is submitted to it.
|
|
<example>
|
|
<title>Dangerous Variable Usage</title>
|
|
<programlisting role="php">
|
|
<![CDATA[
|
|
<?php
|
|
// remove a file from the user's home directory... or maybe
|
|
// somebody else's?
|
|
unlink ($evil_var);
|
|
|
|
// Write logging of their access... or maybe an /etc/passwd entry?
|
|
fwrite ($fp, $evil_var);
|
|
|
|
// Execute something trivial.. or rm -rf *?
|
|
system ($evil_var);
|
|
exec ($evil_var);
|
|
|
|
?>
|
|
]]>
|
|
</programlisting>
|
|
</example>
|
|
</para>
|
|
<para>
|
|
You should always carefully examine your code to make sure that any
|
|
variables being submitted from a web browser are being properly
|
|
checked, and ask yourself the following questions:
|
|
<itemizedlist>
|
|
<listitem>
|
|
<simpara>
|
|
Will this script only affect the intended files?
|
|
</simpara>
|
|
</listitem>
|
|
<listitem>
|
|
<simpara>
|
|
Can unusual or undesirable data be acted upon?
|
|
</simpara>
|
|
</listitem>
|
|
<listitem>
|
|
<simpara>
|
|
Can this script be used in unintended ways?
|
|
</simpara>
|
|
</listitem>
|
|
<listitem>
|
|
<simpara>
|
|
Can this be used in conjunction with other scripts in a negative
|
|
manner?
|
|
</simpara>
|
|
</listitem>
|
|
<listitem>
|
|
<simpara>
|
|
Will any transactions be adequately logged?
|
|
</simpara>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</para>
|
|
<para>
|
|
By adequately asking these questions while writing the script,
|
|
rather than later, you prevent an unfortunate re-write when you
|
|
need to increase your security. By starting out with this mindset,
|
|
you won't guarantee the security of your system, but you can help
|
|
improve it.
|
|
</para>
|
|
<para>
|
|
You may also want to consider turning off register_globals,
|
|
magic_quotes, or other convenience settings which may confuse
|
|
you as to the validity, source, or value of a given variable.
|
|
Working with PHP in error_reporting(E_ALL) mode can also help warn
|
|
you about variables being used before they are checked or
|
|
initialized (so you can prevent unusual data from being
|
|
operated upon).
|
|
</para>
|
|
</chapter>
|
|
|
|
<!-- Keep this comment at the end of the file
|
|
Local variables:
|
|
mode: sgml
|
|
sgml-omittag:t
|
|
sgml-shorttag:t
|
|
sgml-minimize-attributes:nil
|
|
sgml-always-quote-attributes:t
|
|
sgml-indent-step:1
|
|
sgml-indent-data:t
|
|
indent-tabs-mode:nil
|
|
sgml-parent-document:nil
|
|
sgml-default-dtd-file:"../../manual.ced"
|
|
sgml-exposed-tags:nil
|
|
sgml-local-catalogs:nil
|
|
sgml-local-ecat-files:nil
|
|
End:
|
|
vim600: syn=xml fen fdm=syntax fdl=2 si
|
|
vim: et tw=78 syn=sgml
|
|
vi: ts=1 sw=1
|
|
-->
|