tailieunhanh - PHP & MySQL Everyday Apps for Dummies phần 2

Phần I: Giới thiệu Phát triển ứng dụng Xác định nguồn gốc của thông tinKhi bạn sử dụng thông tin từ một nguồn bên ngoài kịch bản, hãy chắc chắn nó đến từ nguồn dự kiến. Ví dụ, nếu bạn vượt qua các thông tin trong một biến ẩn dưới các hình thức, hãy chắc chắn bạn sẽ có được thông tin từ mảng $ _POST. | 26 Part I Introducing Application Development Specifying the source of the information When you use information from a source outside the script be sure it s coming from the expected source. For instance if you pass information in a hidden variable in a form be sure you get the information from the _POST array. For instance suppose your application logs in a customer and then passes the authorization variable such as login yes in a hidden variable in the form. When you check whether a user is authorized to view a Web page you need to use code such as the following if _POST login yes echo You are not logged in Then if a user tried to access your Web site with the following URL http login yes the user would not be able to see the page because the authorization variable is in _GET login not in _POST login . Getting form variables from the _POST array is the most secure method. If you check the authorization variable in _REQUEST login the user would appear to be logged in because the elements of both the _POST and the _GET arrays are included in _REQUEST. Another method is to turn the register_globals setting on in . Then a variable called login would be available. You could use the following check if login yes echo You are not logged in However this code also doesn t check where the information came from. If the user accessed your site with the login variable in the URL the user would appear to be logged in. The most secure programming checks the source of the information. You should leave register_globals turned off which is the default and get the information from the appropriate superglobal array. This alone isn t enough for secure programming. However it can help make your application more secure. Checking the data type of outside information Your PHP script should check all information received from an outside source to be sure it contains the expected information. Chapter 2 Building in Application Security 27 You can check the type of .