Given Edward
JF-Expert Member
- Jan 11, 2011
- 850
- 203
Personally sijui sana PHP. In fact, I'm completely a beginner. But the few that I learn I share with you guys here at JF so that we can develop our skills and build a better tomorrow.
Unapotoa service inayotumia internet,inabidi suala la security likae akilini mwako wakati unachapa codes zako. Inaweza ikaonekana kama PHP scripts nyingi haziko sensitive na masuala ya security; hii inatokana na namba kubwa ya inexperienced programmers working in the language. Hata hivyo, there is no reason for you to have an inconsistent security policy based on a rough guess at your code's significance. The moment you put anything financially interesting on your server, it becomes likely that someone will try to casually hack it. Create a forum program or any sort of shopping cart, and the probability of attack rises to a dead certainty.
Here are a few general security guidelines;-
Don't trust forms/Usiziamini forms
Kuhack forms forms ni trivial. Ndio, kwa kutumia silly JavaScript trick, you may be able to limit your form to allow only the numbers 1 through 5 in a rating field. Lakini pale mtu atakapozima JavaScript iwe offf kwenye browser yao, au akipost custom form data, client-side validation yako inayeyuka kama bafafu kwenye frampeni
Users wana interact na scripts zako scripts primarily kupitia form parameters, na hivyo wao ndio the biggest security risk. Tunajifunza nini? Siku zote validate data ambazo zinapitia any PHP script kwenye PHP script.
Don't trust users/Usiwaamini watumiaji wako
Assume that every piece of data your website gathers is laden with harmful code. Sanitize every piece, even if you're positive that nobody would ever try to attack your site. Paranoia pays off.
Turn off global variables
Asikwambie mtu,the biggest security hole you can have is having the register_globals configuration parameter enabled. Mercifully, it's turned off by default in PHP 4.2 and later.
Novice programmers wanaonyesha registered globals kama ni ya ulazima, lakini hawagundui how dangerous this setting is. Server yenye global variables enabled automatically assigns global variables to any form parameters. Kwa idea kidogo ya jinsi hii inavyofanya kazi na kwanini ni hatari , tuangalie mfano huu:-
Tuseme una script inaitwa process.php ambayo inaingiza form data kwenye user database yako. Form original inaonekana hivi:
Unapo run process.php, PHPyenye registered globals enabled inaweka values za hii parameter kwenye $username variable. This saves some typing over accessing them through $_POST['username'] au $_GET['username']. Kwa bahati mbaya, hii pia inaacha uwazi kwa security problems , because PHP sets a variable for any value sent to the script via a GET or POST parameter, and that is a big problem if you didn't explicitly initialize the variable and you don't want someone to manipulate it.
Angalia hii script chini, kw mfano-kama $authorized variable ni true, itaonyesha confidential data to the user. Katika hali ya kawaida, the $authorized variable inakuwa set to true only kama user amekuwa properly authenticated kupitia the hypothetical authenticated_user() function. Lakini kama you have register_globals active, Yoyote anaweza ku send a GET parameter such as authorized=1 ku override this:
Recommended Security Configuration Options
Kuna several PHP configuration settings that affect security features. Here are the ones that I use for production servers:
In general, kama ukikuta kuna code inatakakutumia these features, usiiamini. Be especially careful of anything that wants to use a function such as system,it's almost certainly flawed.
Ahsanteni.
Unapotoa service inayotumia internet,inabidi suala la security likae akilini mwako wakati unachapa codes zako. Inaweza ikaonekana kama PHP scripts nyingi haziko sensitive na masuala ya security; hii inatokana na namba kubwa ya inexperienced programmers working in the language. Hata hivyo, there is no reason for you to have an inconsistent security policy based on a rough guess at your code's significance. The moment you put anything financially interesting on your server, it becomes likely that someone will try to casually hack it. Create a forum program or any sort of shopping cart, and the probability of attack rises to a dead certainty.
Here are a few general security guidelines;-
Don't trust forms/Usiziamini forms
Kuhack forms forms ni trivial. Ndio, kwa kutumia silly JavaScript trick, you may be able to limit your form to allow only the numbers 1 through 5 in a rating field. Lakini pale mtu atakapozima JavaScript iwe offf kwenye browser yao, au akipost custom form data, client-side validation yako inayeyuka kama bafafu kwenye frampeni
Users wana interact na scripts zako scripts primarily kupitia form parameters, na hivyo wao ndio the biggest security risk. Tunajifunza nini? Siku zote validate data ambazo zinapitia any PHP script kwenye PHP script.
Don't trust users/Usiwaamini watumiaji wako
Assume that every piece of data your website gathers is laden with harmful code. Sanitize every piece, even if you're positive that nobody would ever try to attack your site. Paranoia pays off.
Turn off global variables
Asikwambie mtu,the biggest security hole you can have is having the register_globals configuration parameter enabled. Mercifully, it's turned off by default in PHP 4.2 and later.
Novice programmers wanaonyesha registered globals kama ni ya ulazima, lakini hawagundui how dangerous this setting is. Server yenye global variables enabled automatically assigns global variables to any form parameters. Kwa idea kidogo ya jinsi hii inavyofanya kazi na kwanini ni hatari , tuangalie mfano huu:-
Tuseme una script inaitwa process.php ambayo inaingiza form data kwenye user database yako. Form original inaonekana hivi:
PHP:
<input name="username" type="text" size="15" maxlength="64">Unapo run process.php, PHPyenye registered globals enabled inaweka values za hii parameter kwenye $username variable. This saves some typing over accessing them through $_POST['username'] au $_GET['username']. Kwa bahati mbaya, hii pia inaacha uwazi kwa security problems , because PHP sets a variable for any value sent to the script via a GET or POST parameter, and that is a big problem if you didn't explicitly initialize the variable and you don't want someone to manipulate it.
Angalia hii script chini, kw mfano-kama $authorized variable ni true, itaonyesha confidential data to the user. Katika hali ya kawaida, the $authorized variable inakuwa set to true only kama user amekuwa properly authenticated kupitia the hypothetical authenticated_user() function. Lakini kama you have register_globals active, Yoyote anaweza ku send a GET parameter such as authorized=1 ku override this:
PHP:
<?php
// Define $authorized = true only if user is authenticated
if (authenticated_user()) {
$authorized = true;
}
?>Recommended Security Configuration Options
Kuna several PHP configuration settings that affect security features. Here are the ones that I use for production servers:
- register_globals set to off.
- safe_mode set to off. This parameter doesn't really make anything safe.
- error_reporting set to off. This is visible error reporting that sends a message to the user's browser if something goes wrong. For production servers, use error logging instead . Development servers can enable error logging as long as they're behind a firewall.
- Disable these functions: system(), exec(), passthru(), shell_exec(), proc_open(), and popen().
- open_basedir set for both the /tmp directory (so that session information can be stored) and the web root so that scripts cannot access files outside a selected area.
- expose_php set to off. This feature adds a PHP signature that includes the version number to the Apache headers. Why would you want to do that?
- allow_url_fopen set to off. This isn't strictly necessary if you're careful about how you access files in your code-that is, you validate all input parameters.
- allow_url_include set to off. There's really no sane reason for anyone to want to access include files via HTTP.
Ahsanteni.