PHP: - PHP |
" , ". . - - WWW-, , - . , , PHP.
-, - -, " , ". - , , PHP, JavaScript, SSI, . , - , .
, 3 : , e-mail . , , - :
<input type=text name=username maxlength=20>
, , - - 20- . , maxlength, - , , web- HTTP-REFERER:
<? $referer=getenv("HTTP_REFERER");
if (!ereg("^http://www.myserver.com", $referer)) {
echo "hacker? he-he...\n";
exit;
}
?>
, , www.myserver.com, . , 100%- , . , HTTP_REFERER , , 80- . . , , 80% - IQ , . , , . - .
. , maxlength :
$username=substr($username,0,20);
- , :
if (empty($username)) {
echo "invalid username";
exit;
}
, , "_" (), :
if (preg_match("/[^(\w)|(\x7F-\xFF)|(\s)]/",$username)) {
echo "invalid username";
exit;
}
, - , , - (Perl-compatible Regular Expressions). PHP- ereg() eregi(). - .
e-mail 1000 "@" ".", . :
if (preg_match("/[^(\w)|(\@)|(\.)]/",$usermail)) {
echo "invalid mail";
exit;
}
- , , , nl2br() htmlspecialchars() - html-. , , : " - , __ ". - , ", , bold'.". , - <img> <bgsound>.
- html-. . , , IP-, . ? - <img src=http://myserver.com/myscript.pl>, , , myscript.pl myserver.com. ( , lynx' :-) ). , location , - - QUERY_STRING, REMOTE_ADDR . . .
- , html- , - , - , , IP . IP - javascript'a :-)
, - . , - , . , , ( ) . , .
, - , , , . admin1.php admin2.php.
- , .htaccess. , web-. , , . - .
, - HTTP - 401. , . 401 web- realm' , . :
if (!isset($PHP_AUTH_USER)) {
Header("WWW-Authenticate: Basic realm=\"My Realm\"");
Header("HTTP/1.0 401 Unauthorized");
exit;
}
admin1.php. , $PHP_AUTH_USER PHP_AUTH_PW, , . , 1000 , SQL-:
*** !!!***
. .
$sql_statement="select password from peoples where name='$PHP_AUTH_USER'";
$result = mysql($dbname, $sql_statement);
$rpassword = mysql_result($result,0,'password');
$sql_statement = "select password('$PHP_AUTH_PW')";
$result = mysql($dbname, $sql_statement);
$password = mysql_result($result,0);
if ($password != $rpassword) {
Header("HTTP/1.0 401 Auth Required");
Header("WWW-authenticate: basic realm=\"My Realm\"");
exit;
}
, , . - - , , .
, : , . $rpassword . MySQL Password(), , , Unix, . - $password == $rpassword, . , , , - :
if (mysql_numrows($result) != 1) {
Header("HTTP/1.0 401 Auth Required");
Header("WWW-authenticate: basic realm=\"My Realm\"");
exit;
}
- . , .
admin2.php. , - admin2.php admin1.php, , - . - , . , "hacker? he-he...".
, 401 . :
- , .
- .
- "", . - . , , www-: , . , - , , , .
, :
adminmode=1. ( - ).
, , adminmode, URL . - .
- . www- - , , , text , hidden, . , hidden. eb5 HTTP_REFERER - , , .
IP-. , , - (sql, dbm, txt-) IP , REMOTE_ADDR , . - , , - "hacker? he-he..." :-)
- , IP , . , - IP-Masquerad' - .
, random uid. .
, , :
mt_srand((double)microtime()*1000000);
$uid=mt_rand(1,1000000);
:
) ;
) .
, ( , ), uid. , , :
<input type=hidden name=uid value=1234567890>
uid , . uid uid', , ... "hacker? he-he...".
, - uid' / "", uid - .
uid "" , . , " ", , - . , - , -, .
, . - IP- - , . IP- REMOTE_ADDR, HTTP_X_FORWARDED_FOR, IP , -. - .
-, , . , , WWW. - - .htaccess (Deny from all).
: http://www.web-support.ru/web-tech/php_4.shtml
| : | PHP |
