{"id":3012,"date":"2025-03-19T22:03:01","date_gmt":"2025-03-19T14:03:01","guid":{"rendered":"https:\/\/www.laixuexila.com\/?p=3012"},"modified":"2025-03-19T22:32:35","modified_gmt":"2025-03-19T14:32:35","slug":"php-%e8%a1%a8%e5%8d%95%e9%aa%8c%e8%af%81%e5%ae%8c%e6%95%b4%e6%8c%87%e5%8d%97","status":"publish","type":"post","link":"https:\/\/www.laixuexila.com\/index.php\/2025\/03\/19\/php-%e8%a1%a8%e5%8d%95%e9%aa%8c%e8%af%81%e5%ae%8c%e6%95%b4%e6%8c%87%e5%8d%97\/","title":{"rendered":"PHP \u8868\u5355\u9a8c\u8bc1"},"content":{"rendered":"\n

\u8868\u5355\u9a8c\u8bc1\u662f Web \u5f00\u53d1\u4e2d\u7684\u91cd\u8981\u73af\u8282\uff0c\u5b83\u786e\u4fdd\u7528\u6237\u8f93\u5165\u7684\u6570\u636e\u7b26\u5408\u9884\u671f\uff0c\u5e76\u9632\u6b62 SQL \u6ce8\u5165\u3001XSS\uff08\u8de8\u7ad9\u811a\u672c\u653b\u51fb\uff09\u548c CSRF\uff08\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\uff09<\/strong> \u7b49\u5b89\u5168\u98ce\u9669\u3002<\/p>\n\n\n\n

\n\n\n\n

1\ufe0f\u20e3 \u8868\u5355\u9a8c\u8bc1\u7684\u91cd\u8981\u6027<\/strong><\/h2>\n\n\n\n

\u2705 \u9632\u6b62\u7a7a\u503c\u63d0\u4ea4<\/strong>\uff1a\u907f\u514d\u7528\u6237\u63d0\u4ea4\u7a7a\u8868\u5355\u3002
\u2705 \u786e\u4fdd\u6570\u636e\u683c\u5f0f\u6b63\u786e<\/strong>\uff1a\u5982\u90ae\u7bb1\u3001\u7535\u8bdd\u53f7\u7801\u3001URL \u683c\u5f0f\u7b49\u3002
\u2705 \u9632\u6b62 XSS \u548c SQL \u6ce8\u5165<\/strong>\uff1a\u786e\u4fdd\u7528\u6237\u8f93\u5165\u6570\u636e\u4e0d\u4f1a\u88ab\u7528\u4e8e\u6076\u610f\u653b\u51fb\u3002
\u2705 \u63d0\u9ad8\u7528\u6237\u4f53\u9a8c<\/strong>\uff1a\u51cf\u5c11\u7528\u6237\u63d0\u4ea4\u9519\u8bef\uff0c\u63d0\u9ad8\u8868\u5355\u53ef\u7528\u6027\u3002<\/p>\n\n\n\n

\n\n\n\n

2\ufe0f\u20e3 HTML \u8868\u5355<\/strong><\/h2>\n\n\n\n

\u9996\u5148\uff0c\u521b\u5efa\u4e00\u4e2a\u5e26\u6709 \u59d3\u540d\u3001\u90ae\u7bb1\u3001\u7f51\u5740\u3001\u5e74\u9f84<\/strong> \u548c \u7559\u8a00<\/strong> \u7684 HTML \u8868\u5355\uff1a<\/p>\n\n\n\n

<form action=\"validate.php\" method=\"post\">\n    <label for=\"name\">\u59d3\u540d:<\/label>\n    <input type=\"text\" name=\"name\" id=\"name\">\n\n    <label for=\"email\">\u90ae\u7bb1:<\/label>\n    <input type=\"text\" name=\"email\" id=\"email\">\n\n    <label for=\"website\">\u7f51\u5740:<\/label>\n    <input type=\"text\" name=\"website\" id=\"website\">\n\n    <label for=\"age\">\u5e74\u9f84:<\/label>\n    <input type=\"text\" name=\"age\" id=\"age\">\n\n    <label for=\"comment\">\u7559\u8a00:<\/label>\n    <textarea name=\"comment\" id=\"comment\"><\/textarea>\n\n    <input type=\"submit\" value=\"\u63d0\u4ea4\">\n<\/form><\/code><\/pre>\n\n\n\n
\n\n\n\n
3\ufe0f\u20e3 PHP \u8868\u5355\u9a8c\u8bc1\u4ee3\u7801<\/strong><\/h2>\n\n\n\n
\u521b\u5efa validate.php<\/code> \u8fdb\u884c\u670d\u52a1\u5668\u7aef\u9a8c\u8bc1\uff1a<\/p>\n\n\n\n
<?php\nif ($_SERVER[\"REQUEST_METHOD\"] == \"POST\") {\n    \/\/ 1\ufe0f\u20e3 \u5b9a\u4e49\u53d8\u91cf\n    $name = $email = $website = $age = $comment = \"\";\n    $errors = [];\n\n    \/\/ 2\ufe0f\u20e3 \u59d3\u540d\u9a8c\u8bc1\uff08\u5fc5\u586b\uff0c\u81f3\u5c112\u4e2a\u5b57\u7b26\uff09\n    if (empty($_POST[\"name\"])) {\n        $errors[] = \"\u59d3\u540d\u4e0d\u80fd\u4e3a\u7a7a\uff01\";\n    } else {\n        $name = test_input($_POST[\"name\"]);\n        if (!preg_match(\"\/^[a-zA-Z\\x{4e00}-\\x{9fa5} ]+$\/u\", $name)) {\n            $errors[] = \"\u59d3\u540d\u53ea\u80fd\u5305\u542b\u5b57\u6bcd\u548c\u7a7a\u683c\uff01\";\n        }\n    }\n\n    \/\/ 3\ufe0f\u20e3 \u90ae\u7bb1\u9a8c\u8bc1\n    if (empty($_POST[\"email\"])) {\n        $errors[] = \"\u90ae\u7bb1\u4e0d\u80fd\u4e3a\u7a7a\uff01\";\n    } else {\n        $email = test_input($_POST[\"email\"]);\n        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {\n            $errors[] = \"\u65e0\u6548\u7684\u90ae\u7bb1\u683c\u5f0f\uff01\";\n        }\n    }\n\n    \/\/ 4\ufe0f\u20e3 \u7f51\u5740\u9a8c\u8bc1\n    if (!empty($_POST[\"website\"])) {\n        $website = test_input($_POST[\"website\"]);\n        if (!filter_var($website, FILTER_VALIDATE_URL)) {\n            $errors[] = \"\u65e0\u6548\u7684\u7f51\u5740\uff01\";\n        }\n    }\n\n    \/\/ 5\ufe0f\u20e3 \u5e74\u9f84\u9a8c\u8bc1\uff08\u5fc5\u987b\u662f\u6570\u5b57\uff09\n    if (!empty($_POST[\"age\"])) {\n        $age = test_input($_POST[\"age\"]);\n        if (!filter_var($age, FILTER_VALIDATE_INT)) {\n            $errors[] = \"\u5e74\u9f84\u5fc5\u987b\u662f\u6574\u6570\uff01\";\n        }\n    }\n\n    \/\/ 6\ufe0f\u20e3 \u7559\u8a00\uff08\u9632\u6b62 XSS\uff09\n    if (!empty($_POST[\"comment\"])) {\n        $comment = test_input($_POST[\"comment\"]);\n    }\n\n    \/\/ 7\ufe0f\u20e3 \u7edf\u4e00\u6570\u636e\u6e05\u7406\u51fd\u6570\n    function test_input($data) {\n        $data = trim($data);             \/\/ \u53bb\u6389\u524d\u540e\u7a7a\u683c\n        $data = stripslashes($data);     \/\/ \u5220\u9664\u53cd\u659c\u6760\n        $data = htmlspecialchars($data); \/\/ \u8f6c\u6362 HTML \u5b9e\u4f53\uff0c\u9632\u6b62 XSS\n        return $data;\n    }\n\n    \/\/ 8\ufe0f\u20e3 \u663e\u793a\u7ed3\u679c\u6216\u9519\u8bef\u4fe1\u606f\n    if (empty($errors)) {\n        echo \"\u2705 \u9a8c\u8bc1\u6210\u529f\uff01<br>\";\n        echo \"\u59d3\u540d: $name <br>\";\n        echo \"\u90ae\u7bb1: $email <br>\";\n        echo \"\u7f51\u5740: $website <br>\";\n        echo \"\u5e74\u9f84: $age <br>\";\n        echo \"\u7559\u8a00: $comment <br>\";\n    } else {\n        foreach ($errors as $error) {\n            echo \"\u274c $error <br>\";\n        }\n    }\n}\n?><\/code><\/pre>\n\n\n\n
\n\n\n\n
4\ufe0f\u20e3 \u8be6\u7ec6\u89e3\u6790<\/strong><\/h2>\n\n\n\n
\u2705 $_SERVER[\"REQUEST_METHOD\"] == \"POST\"<\/code>\uff1a\u786e\u4fdd\u6570\u636e\u662f POST<\/code> \u63d0\u4ea4\u7684\u3002
\u2705 empty($_POST[\"name\"])<\/code>\uff1a\u68c0\u67e5\u662f\u5426\u4e3a\u7a7a\u3002
\u2705 preg_match(\"\/^[a-zA-Z\\x{4e00}-\\x{9fa5} ]+$\/u\", $name)<\/code>\uff1a\u68c0\u67e5\u59d3\u540d\u662f\u5426\u53ea\u5305\u542b \u5b57\u6bcd\u3001\u6c49\u5b57\u548c\u7a7a\u683c<\/strong>\u3002
\u2705 filter_var($email, FILTER_VALIDATE_EMAIL)<\/code>\uff1a\u68c0\u67e5\u90ae\u7bb1\u683c\u5f0f\u3002
\u2705 filter_var($website, FILTER_VALIDATE_URL)<\/code>\uff1a\u68c0\u67e5\u7f51\u5740\u662f\u5426\u6709\u6548\u3002
\u2705 filter_var($age, FILTER_VALIDATE_INT)<\/code>\uff1a\u786e\u4fdd\u5e74\u9f84\u662f\u6574\u6570\u3002
\u2705 htmlspecialchars()<\/code>\uff1a\u9632\u6b62 XSS\uff08\u8de8\u7ad9\u811a\u672c\u653b\u51fb\uff09\u3002
\u2705 stripslashes()<\/code>\uff1a\u53bb\u6389\u53cd\u659c\u6760\uff0c\u907f\u514d SQL \u6ce8\u5165\u3002
\u2705 trim()<\/code>\uff1a\u53bb\u6389\u524d\u540e\u7a7a\u683c\uff0c\u9632\u6b62\u7528\u6237\u8bef\u8f93\u5165\u7a7a\u683c\u3002<\/p>\n\n\n\n
\n\n\n\n
5\ufe0f\u20e3 \u9632\u6b62 CSRF\uff08\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\uff09<\/strong><\/h2>\n\n\n\n
\u5728 HTML \u8868\u5355\u4e2d\u6dfb\u52a0 CSRF \u4ee4\u724c\uff1a<\/p>\n\n\n\n
<?php\nsession_start();\n$_SESSION[\"csrf_token\"] = bin2hex(random_bytes(32));\n?>\n<form action=\"validate.php\" method=\"post\">\n    <input type=\"hidden\" name=\"csrf_token\" value=\"<?php echo $_SESSION['csrf_token']; ?>\">\n    <input type=\"text\" name=\"name\">\n    <input type=\"submit\" value=\"\u63d0\u4ea4\">\n<\/form><\/code><\/pre>\n\n\n\n
\u5728 validate.php<\/code> \u9a8c\u8bc1 CSRF \u4ee4\u724c<\/strong>\uff1a<\/p>\n\n\n\n
session_start();\nif ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {\n    die(\"CSRF \u9a8c\u8bc1\u5931\u8d25\uff01\");\n}<\/code><\/pre>\n\n\n\n
\u2705 \u539f\u7406<\/strong>\uff1a\u6bcf\u4e2a\u8868\u5355\u63d0\u4ea4\u65f6\u9644\u5e26 csrf_token<\/code>\uff0c\u9632\u6b62\u6076\u610f\u7f51\u7ad9\u4f2a\u9020\u8bf7\u6c42\u3002<\/p>\n\n\n\n
\n\n\n\n
6\ufe0f\u20e3 \u9632\u6b62\u8868\u5355\u91cd\u590d\u63d0\u4ea4<\/strong><\/h2>\n\n\n\n
\u7528\u6237\u5237\u65b0\u9875\u9762\u4f1a\u5bfc\u81f4\u8868\u5355\u91cd\u590d\u63d0\u4ea4\uff0c\u53ef\u4ee5\u4f7f\u7528 header(\"Location: success.php\")<\/code><\/strong> \u89e3\u51b3\uff1a<\/p>\n\n\n\n
if ($_SERVER[\"REQUEST_METHOD\"] == \"POST\") {\n    \/\/ \u5904\u7406\u6570\u636e\n    header(\"Location: success.php\"); \/\/ \u91cd\u5b9a\u5411\uff0c\u907f\u514d\u91cd\u590d\u63d0\u4ea4\n    exit;\n}<\/code><\/pre>\n\n\n\n
\u2705 \u539f\u7406<\/strong>\uff1a\u63d0\u4ea4\u540e\u91cd\u5b9a\u5411\u5230 success.php<\/code>\uff0c\u5237\u65b0\u4e0d\u4f1a\u91cd\u590d\u63d0\u4ea4\u6570\u636e\u3002<\/p>\n\n\n\n
\n\n\n\n
7\ufe0f\u20e3 \u4f7f\u7528 JavaScript \u8fdb\u884c\u524d\u7aef\u9a8c\u8bc1<\/strong><\/h2>\n\n\n\n
\u867d\u7136\u670d\u52a1\u5668\u7aef\u9a8c\u8bc1\u662f\u5fc5\u987b\u7684\uff0c\u4f46\u53ef\u4ee5\u4f7f\u7528 JavaScript \u8fdb\u884c\u524d\u7aef\u9a8c\u8bc1\uff0c\u63d0\u9ad8\u7528\u6237\u4f53\u9a8c\uff1a<\/p>\n\n\n\n
<script>\nfunction validateForm() {\n    let name = document.getElementById(\"name\").value;\n    let email = document.getElementById(\"email\").value;\n\n    if (name.trim() === \"\") {\n        alert(\"\u59d3\u540d\u4e0d\u80fd\u4e3a\u7a7a\uff01\");\n        return false;\n    }\n\n    let emailPattern = \/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$\/;\n    if (!email.match(emailPattern)) {\n        alert(\"\u8bf7\u8f93\u5165\u6709\u6548\u7684\u90ae\u7bb1\uff01\");\n        return false;\n    }\n\n    return true;\n}\n<\/script><\/code><\/pre>\n\n\n\n
\u2705 \u524d\u7aef\u9a8c\u8bc1<\/strong>\u53ef\u4ee5 \u51cf\u5c11\u670d\u52a1\u5668\u8d1f\u62c5<\/strong>\uff0c\u4f46\u4e0d\u80fd\u66ff\u4ee3\u670d\u52a1\u5668\u7aef\u9a8c\u8bc1\u3002<\/p>\n\n\n\n
\n\n\n\n
8\ufe0f\u20e3 \u603b\u7ed3<\/strong><\/h2>\n\n\n\n
\u9a8c\u8bc1\u7c7b\u578b<\/strong><\/th>\u65b9\u6cd5<\/strong><\/th><\/tr><\/thead>
\u5fc5\u586b\u5b57\u6bb5<\/td>empty($value)<\/code><\/td><\/tr>
\u5b57\u7b26\u9650\u5236<\/td>preg_match(\"\/\u6b63\u5219\/\")<\/code><\/td><\/tr>
\u90ae\u7bb1\u683c\u5f0f<\/td>filter_var($email, FILTER_VALIDATE_EMAIL)<\/code><\/td><\/tr>
URL \u683c\u5f0f<\/td>filter_var($website, FILTER_VALIDATE_URL)<\/code><\/td><\/tr>
\u6570\u5b57\u683c\u5f0f<\/td>filter_var($age, FILTER_VALIDATE_INT)<\/code><\/td><\/tr>
\u9632\u6b62 XSS<\/td>htmlspecialchars($data)<\/code><\/td><\/tr>
\u9632\u6b62 CSRF<\/td>$_SESSION['csrf_token']<\/code><\/td><\/tr>
\u9632\u6b62\u91cd\u590d\u63d0\u4ea4<\/td>header(\"Location: success.php\")<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\ud83d\udccc \u63a8\u8350\u9605\u8bfb<\/strong><\/p>\n\n\n\n