PHP安全之防止.inc配置信息暴露

<Files ~ ".inc$">
    Order allow,deny
    Deny from all
</Files>

phpinfo,eval,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,fsocket,fsockopen

<?php
//PHP4调用方法
dl('../../../../../home/apache/htdocs/php4.so');
biguanspider('uname -a');//调用函数
?> www.111cn.net

<?php
//PHP5调用方法
dl('../../../../../home/apache/htdocs/php5.so');
spiderbiguan('uname -a');//调用函数
?>

<?php
if($_POST){
    if($_SESSION["token"]!=$_POST["token"]){
        die("非法提交！");
    }else{
        echo "安全提交!";
    }
}
$_SESSION["token"]=md5(rand(1,999));//没生成一次表单，修改一次值，不要在post处理前修改它，不然无法比对 www.111cn.net
?>
<form action="1.php" method="post">
<input type="hidden" value="<?php echo $_SESSION["token"]?>" name="token">
<input type="submit" value="提交" />
</form>

<?php

$value = $_COOKIE[“value”]; //读取上一次设置的Cookie值

if（count（$_POST）） {

$long = “”;

while（list（$key,$value）=each（$_POST））$long.=$value;

$hash = md5（$long）；

setcookie（“value”,$hash,time（）+60*60）； //重新设置cookie

}

if（$value!=$hash） {

// 如果两次的MD5值不一样就对数据进行进一步操作

} else {

//如果两次MD5的值相同，告知用户提交失败 ,为重复提交表单

}

?>

$s = is_numeric($_GET['s'])?$_GET['s']:0;
$sql="insert into test(type)values($s);";  //是 values($s) 不是values('$s')
mysql_query($sql);

$id = intval($_GET['id']);

echo intval(42); // 42
echo intval(4.2); // 4
echo intval('42'); // 42
echo intval('+42'); // 42
echo intval('-42'); // -42
echo intval(042); // 34
echo intval('042'); // 42
echo intval(1e10); // 1410065408
echo intval('1e10'); // 1
echo intval(0x1A); // 26
echo intval(42000000); // 42000000
echo intval(420000000000000000000); // 0
echo intval('420000000000000000000'); // 2147483647
echo intval(42, 8); // 42
echo intval('42', 8); // 34
?>

<?php

/* 全局安全处理 */

switch ($_GET['task'])
{
case 'print_form':
include '/inc/presentation/form.inc';
break;

case 'process_form':
$form_valid = false;
include '/inc/logic/process.inc';
if ($form_valid)
{
include '/inc/presentation/end.inc';
}
else
{
include '/inc/presentation/form.inc';
}
break;

default:
include '/inc/presentation/index.inc';
break;
}

?>

<?php

switch ($_POST['form'])
{
case 'login':
$allowed = array();
$allowed[] = 'form';
$allowed[] = 'username';
$allowed[] = 'password';

$sent = array_keys($_POST);

if ($allowed == $sent)
{
include '/inc/logic/process.inc';
}

break;
}

?>

<?php

$clean = array();

$email_pattern = '/^[^@s<&>]+@([-a-z0-9]+.)+[a-z]{2,}$/i';

if (preg_match($email_pattern, $_POST['email']))
{
$clean['email'] = $_POST['email'];
}

?>

<?php

$clean = array();

switch ($_POST['color'])
{
case 'red':
case 'green':
case 'blue':
$clean['color'] = $_POST['color'];
break;
}

?>

<?php

$clean = array();

if ($_POST['num'] == strval(intval($_POST['num'])))
{
$clean['num'] = $_POST['num'];
}

?>

<?php

$clean = array();

if ($_POST['num'] == strval(floatval($_POST['num'])))
{
$clean['num'] = $_POST['num'];
}

?>

<?PHP
//PHP整站防注入程序，需要在公共文件中require_once本文件
//判断magic_quotes_gpc状态
if (@get_magic_quotes_gpc ()) {
$_GET = sec ( $_GET );
$_POST = sec ( $_POST );
$_COOKIE = sec ( $_COOKIE );
$_FILES = sec ( $_FILES );
}
$_SERVER = sec ( $_SERVER );
function sec(&$array) {
//如果是数组，遍历数组，递归调用
if (is_array ( $array )) {
foreach ( $array as $k => $v ) {
$array [$k] = sec ( $v );
}
} else if (is_string ( $array )) {
//使用addslashes函数来处理
$array = addslashes ( $array );
} else if (is_numeric ( $array )) {
$array = intval ( $array );
}
return $array;
}
//整型过滤函数
function num_check($id) {
if (! $id) {
die ( '参数不能为空！' );
} //是否为空的判断
else if (inject_check ( $id )) {
die ( '非法参数' );
} //注入判断
else if (! is_numetic ( $id )) {
die ( '非法参数' );
}
//数字判断
$id = intval ( $id );
//整型化
return $id;
}
//字符过滤函数
function str_check($str) {
if (inject_check ( $str )) {
die ( '非法参数' );
}
//注入判断
$str = htmlspecialchars ( $str );
//转换html
return $str;
}
function search_check($str) {
$str = str_replace ( "_", "_", $str );
//把"_"过滤掉
$str = str_replace ( "%", "%", $str );
//把"%"过滤掉
$str = htmlspecialchars ( $str );
//转换html
return $str;
}
//表单过滤函数
function post_check($str, $min, $max) {
if (isset ( $min ) && strlen ( $str ) < $min) {
die ( '最少$min字节' );
} else if (isset ( $max ) && strlen ( $str ) > $max) {
die ( '最多$max字节' );
}
return stripslashes_array ( $str );
}
//防注入函数
function inject_check($sql_str) {
return eregi ( 'select|inert|update|delete|'|/*|*|../|./|UNION|into|load_file|outfile', $sql_str );
// www.111cn.net 进行过滤，防注入
}
function stripslashes_array(&$array) {
if (is_array ( $array )) {
foreach ( $array as $k => $v ) {
$array [$k] = stripslashes_array ( $v );
}
} else if (is_string ( $array )) {
$array = stripslashes ( $array );
}
return $array;
}
?>