If your PHP pages include() or require() files that live within the web server document root, for example library files in the same directory as the PHP pages, you must account for the possibility that attackers may call those library files directly.
Any program level code in the library files (ie code not part of function definitions) will be directly executable by the caller outside of the scope of the intended calling sequence. An attacker may be able to leverage this ability to cause unintended effects.
The most robust way to guard against this possibility is to prevent your webserver from calling the library scripts directly, either by moving them out of the document root, or by putting them in a folder configured to refuse web server access. With Apache for example, create a .htaccess file in the library script folder with these directives:
Order Allow,Deny
Deny from any
PHP - Manual: 安全
2024-11-14
安全
add a note
User Contributed Notes 14 notes
ocrow at simplexity dot net ¶
18 years ago
djjokla AT gmail dot com ¶
16 years ago
If a single file has to be included than I use the following
index.php ( where the file is gonna be included )
___________
<?php
define('thefooter', TRUE);
include('folder/footer.inc.php');
?>
and the footer file (for example) looks this way then
footer.inc.php ( the file to be inluded )
___________
<?php
defined('thefooter') or die('Not with me my friend');
echo('Copyright to me in the year 2000');
?>
So when someone tries to access the footer.php file directly he/she/it will get the "Not with me my friend" messages written on the screen. An alternative option is to redirect the person who wants to access the file directly to a different location, so instead of the above code you would have to write the following in the footer.inc.php file.
<?php
defined('thefooter') or header('Location: http://www.location.com');
echo('Copyright to me in the year 2000');
?>
In normal case a redirection to an external site would be annoying to the visitor, but since this visitor is more interested in hacking the site than in reading the content, I think it's only fair to create such an redirection. We dont' realy want someome like this on our sites.
For the file protection I use .htaccess in which I say to protect the file itself and every .inc file
<Files ~ "^.*\.([Hh][Tt]|[Ii][Nn][Cc])">
Order allow,deny
Deny from all
Satisfy All
</Files>
The .htaccess file should result an Error 403 if someone tries to access the files directly. If for some reason this shouldn't work, then the "Not with me my friend" text apears or a redirection (depending what is used)
In my eyes this looks o.k. and safe.
k ¶
15 years ago
How about not putting the php code in the web-root at all...?
You can create a public directory with the css, html, etc and index.php there. Then use the include_path setting to point to the actual php code, eg...
webstuff
phpcode
public
images
css
index.php
then set the include path to "../phpcode" and, as php is executed from the directory of the script, all should be well.
I'd also call the main index "main.page", or something else, instead of "index.php" and change the web server default index page. That way you cant get hit by things trawlling the web for index pages.
Ray.Paseur sometimes uses Gmail ¶
5 years ago
Password hashing should be linked here:
http://php.net/manual/en/faq.passwords.php
dangan at blackjaguargaming dot net ¶
15 years ago
I'd recommend a 404 over a 403 considering a 403 proves there is something worth hacking into.
index.php:
<?php
define('isdoc',1);
include('includes/include.sqlfunctions.php');
// Rest of code for index.php
?>
include.sqlfunctions.php (or other include file):
<?php
if(isdoc !== 1) // Not identical to 1
{
header('HTTP/1.1 404 Not Found');
echo "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head>";
echo "<body>\n<h1>Not Found</h1>\n<p>The requested URL ".$_SERVER['REQUEST_URI']." was not found on this server.</p>\n";
echo "<hr>\n".$_SERVER['SERVER_SIGNATURE']."\n</body></html>\n";
// Echo output similar to Apache's default 404 (if thats what you're using)
exit;
}
// Rest of code for this include
?>
steffen at morkland dot com ¶
15 years ago
In Reply to djjokla and others
Consider placing all incude files as mentioned before in a seperate folder containing a .htaccess containing a Order Deny,Allow
the create a index file, which is intended to handle ALL request made to you php application, then call it with index.php?view=index
the index file could look a bit like this:
<?php
switch($_GET['view']){
case 'index':
include('libs/index.php');
break;
default:
include('libs/404.php');
break;
}
?>
this could be an array or something even more creative. it actually does'nt matter how you do it... running all pages through one central script has one big advantage.... CONTROL.
at any givin time, you can easily implement access control to functions without forgetting crucial files.
ManifoldNick at columbus dot rr dot com ¶
19 years ago
Remember that security risks often don't involve months of prep work or backdoors or whatever else you saw on Swordfish ;) In fact one of the bigges newbie mistakes is not removing "<" from user input (especially when using message boards) so in theory a user could secerely mess up a page or even have your server run php scripts which would allow them to wreak havoc on your site.
Thomas "Balu" Walter ¶
16 years ago
Since many users can not modify apache configurations or use htaccess files, the best way to avoid unwanted access to include files would be a line at the beginning of the include-file:
<?php if (!defined('APPLICATION')) exit; ?>
And in all files that are allowed to be called externally:
<?php define('APPLICATION', true); ?>
Balu
Anonymous ¶
6 years ago
chroot is NOT a security feature. Don't use it as one. Please read the man pages of chroot to understand what its really used for
annonymous at domain dot com ¶
18 years ago
best bet is to build php as cgi, run under suexec, with chroot jailed users. Not the best, but fairly unobtrusive, provides several levels of checkpoints, and has only the detriment of being, well, kinda slow. 8)
inland14 at live dot com ¶
3 years ago
Good Dharma tokens which are basically in the feed somewhere that allow users that are not reprogramming and injecting to get into the site.
Change this POST AJAX call URL every couple minutes to exclude users who didn't follow your portal. You can combine this with where they came from. Just in the case of advertised click-thrus.
You can make a perfectly good token from time() and some measure away from it every ~5th minute(?). Balance the load by free token grasping at login, or even if they just got to the site. And don't let them into the feed past the designated 5th minute, or algorithmic sum for your timed change of the guard, without knowledge of the token. This can be caught up by passing variables across pages. Directly injecting the POST token with a curl to your own site. And combining that like a session ID.
nick dot hristov at gmail dot com ¶
17 years ago
A correction to previous post by Dave Mink.
<Files ~ "\.inc$">
Order allow,deny
Deny from all
Satisfy All
</Files>
Will not stop something like
http://www.yourserver.com/includefile.inc?pointlessvar=blahblah
Here is something more sophisticated for this task:
<Location ~ "/[^ ](?=\.inc(\?[^ ]*)?)/">
Options None
Order Allow, Deny
Deny from All
AllowOverride None
Satisfy All
</Location>
Also, consider placing in your httpd.conf
<Location ~ "/[^ ](?=\.phps(\?[^ ]*)?)/">
Options None
Order Allow, Deny
Deny from All
AllowOverride None
Satisfy All
</Location>
moehbass at gmail dot com ¶
14 years ago
First, q much simpler solution to preventing people from viewing code inside of an includable file would be to give include file an extension that ends with php (e.g. myFile.inc.php).
Secondly, and more importantly, why on earth would you want to put program-level code in an include file? By that I mean something life this:
myFile.inc.php
--------------------------------
...
if ($var = 'whatever')
// connect to the database
else
// do something else.
--------------------------------
An include file should not contain logic! Rather, it is an encapsulated unit of code that should not do anything on its own unless asked to. To implement this ideology, consider including function definitions only in your include files, then once you include them in the script, call such functions from within your program (i.e. the script that included the inc file). If you don't know the names of the functions ab initio, use call_user_func() or call_user_func_array() and pass it the name of the function that's dependent on context.
If you MUST put program-level logic in your include files, consider simply putting it in the program!
Why should you consider this? How about variable name clashes for a starter! You can think of more, I am shure!
Hope that helped
IT
PHP
编程语言
Linux
开发编程
科技
Elasticsearch
HTML/CSS/XML
网络
JAVA
NoSQL
数据库
面试
C/C++
Golang
Git
算法
操作系统
正则表达式
Redis
互联网
MySql
JavaScript
运维
软件
国际
架构设计
Mac OS
TCP/IP
Excel
Vim
Windows
Socket
Oracle
VR
MongoDB
Python
运营
MemCache
商业
硬件
电子
娱乐
设计
nginx
摄影
游戏
WordPress
HTTP
团建
数码电器
广告
--
php7 安装fileinfo扩展
preg_split — 通过一个正则表达式分隔字符串
php位值,解决 PHP 中 usort 在值相同时改变原始位置的问题
[PHP] inet_pton/inet_ntop IP地址转换函数
array_multisort() 多字段排序
PHPMailer设置utf8 PHPMailer字符集CharSet
ADORecordSet对象
adodb手册
PHP 8.1
[鸟哥]PHP_INT_MIN 和 -9223372036854775808
Composer的Packagist资源
opcache预加载
mysql面试题
[鸟哥]PHP FFI详解 - 一种全新的PHP扩展方式
PHP7添加redis扩展
PHPstorm 里面Terminal 不能使用 esc键吗退出编辑模式吗
php设置cookie为httponly防止xss攻击
PHP mkdir()写出来的权限与mode值不符合
支持php7的性能采集扩展
adodb连接mysql多个数据库的问题