PHP security-source code exposure (2)
## Source code exposed
Your WEB server must be able to read your source code and execute it. This means that when the code written by anyone is run by the server, it can also read your source code. On a shared hosting, the biggest risk is that because the WEB server is shared, PHP code written by other developers can read arbitrary files.
<?php header('Content-Type: text/plain'); readfile($_GET['file']); ?>
## By running the above script on the host where your source code resides, an attacker can cause the WEB server to read and display any file by specifying the file value as a full path and file name. For example, assuming that the script is named file.php and is located on the host example.org, the contents of the file /path/to/source.php can be exposed by accessing the following link:
http://www.php.cn/
Of course, for this simple code to work, an attacker would have to know exactly where your source code is, but an attacker could write a more complex script that would allow them to browse the entire file system. For such scripts, see the examples later in this chapter.
There is no perfect solution to this problem. As discussed in Chapter 5, you must consider that all of your source code is public, even code that is stored outside of your home WEB directory.
The best approach is to keep all sensitive data in a database. While this adds an extra layer of complexity to writing some code, it's the best way to prevent your sensitive data from being exposed. Unfortunately, there is another problem. How to save your database access password?
Please look at a file named db.inc saved outside the main directory of the website:
<?php
$db_user = 'myuser';
$db_pass = 'mypass';
$db_host = 'localhost';
$db = mysql_connect($db_host, $db_user,
$db_pass);
?>
If the path to the file is known (or guessed), there is a possibility that another user on your server accesses the file and will gain database access, so that all the data you save in the database will be will be exposed.
The best solution to this problem is to save your database access permissions in a file that can only be read by system administrators in the following format:
SetEnv DB_USER "myuser"
SetEnv DB_PASS "mypass"
## SetEnv is an Apache command. The above file means to create two Apache environment variables that represent your database username and password respectively. Of course, the key to this trick is that only system administrators can read the file. If you can't log in as a system administrator, you can restrict the file to being readable only by yourself, which is a similar protection method as above.
$ chmod 600 db.conf $ ls db.conf -rw------- 1 chris chris 48 May 21 12:34 db.conf
## This effectively prevents malicious scripts from gaining access to your data, so there is no significant risk to the security of sensitive data held in the database.
For this file to work, you need to be able to access the data in it through PHP. To achieve this goal, you need to write the following inclusion sentence in httpd.conf:
Include "/path/to/db.conf"
It should be noted that this statement needs to be inserted in the VirtualHost area, otherwise other users can obtain the corresponding content.
Since the parent process of Apache runs as a system administrator (needs to bind to port 80), it is able to read the configuration file, but the child process that handles server requests (running PHP scripts) cannot read the file.
You can access these two variables through the $_SERVER super global array, so in db.inc, you only need to reference the $_SERVER variable instead of stating the database permissions:
<?php $db_user = $_SERVER['DB_USER']; $db_pass = $_SERVER['DB_PASS']; $db_host = 'localhost'; $db = mysql_connect($db_host, $db_user, $db_pass); ?>
If the file is exposed, database access will not be compromised. This is a major security improvement for shared hosting, and it is also an in-depth defense method for independent hosting.
Note that when using the above technique, database access rights are located in the $_SERVER super public array. This requires also restricting ordinary visitors from running phpinfo() to view or any other reasons that cause the contents of $_SERVER to be exposed.
Of course, you can use this technique to protect any information (not just database access), but I find it more convenient to save most data in a database, especially since this technique requires assistance from your hosting provider.
The above is the content of PHP Security-Source Code Exposure (2). For more related content, please pay attention to the PHP Chinese website (www.php.cn)!
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
PHP 8.4 Installation and Upgrade guide for Ubuntu and Debian
Dec 24, 2024 pm 04:42 PM
PHP 8.4 brings several new features, security improvements, and performance improvements with healthy amounts of feature deprecations and removals. This guide explains how to install PHP 8.4 or upgrade to PHP 8.4 on Ubuntu, Debian, or their derivati
7 PHP Functions I Regret I Didn't Know Before
Nov 13, 2024 am 09:42 AM
If you are an experienced PHP developer, you might have the feeling that you’ve been there and done that already.You have developed a significant number of applications, debugged millions of lines of code, and tweaked a bunch of scripts to achieve op
How To Set Up Visual Studio Code (VS Code) for PHP Development
Dec 20, 2024 am 11:31 AM
Visual Studio Code, also known as VS Code, is a free source code editor — or integrated development environment (IDE) — available for all major operating systems. With a large collection of extensions for many programming languages, VS Code can be c
Explain JSON Web Tokens (JWT) and their use case in PHP APIs.
Apr 05, 2025 am 12:04 AM
JWT is an open standard based on JSON, used to securely transmit information between parties, mainly for identity authentication and information exchange. 1. JWT consists of three parts: Header, Payload and Signature. 2. The working principle of JWT includes three steps: generating JWT, verifying JWT and parsing Payload. 3. When using JWT for authentication in PHP, JWT can be generated and verified, and user role and permission information can be included in advanced usage. 4. Common errors include signature verification failure, token expiration, and payload oversized. Debugging skills include using debugging tools and logging. 5. Performance optimization and best practices include using appropriate signature algorithms, setting validity periods reasonably,
PHP Program to Count Vowels in a String
Feb 07, 2025 pm 12:12 PM
A string is a sequence of characters, including letters, numbers, and symbols. This tutorial will learn how to calculate the number of vowels in a given string in PHP using different methods. The vowels in English are a, e, i, o, u, and they can be uppercase or lowercase. What is a vowel? Vowels are alphabetic characters that represent a specific pronunciation. There are five vowels in English, including uppercase and lowercase: a, e, i, o, u Example 1 Input: String = "Tutorialspoint" Output: 6 explain The vowels in the string "Tutorialspoint" are u, o, i, a, o, i. There are 6 yuan in total
How do you parse and process HTML/XML in PHP?
Feb 07, 2025 am 11:57 AM
This tutorial demonstrates how to efficiently process XML documents using PHP. XML (eXtensible Markup Language) is a versatile text-based markup language designed for both human readability and machine parsing. It's commonly used for data storage an
Explain late static binding in PHP (static::).
Apr 03, 2025 am 12:04 AM
Static binding (static::) implements late static binding (LSB) in PHP, allowing calling classes to be referenced in static contexts rather than defining classes. 1) The parsing process is performed at runtime, 2) Look up the call class in the inheritance relationship, 3) It may bring performance overhead.
What are PHP magic methods (__construct, __destruct, __call, __get, __set, etc.) and provide use cases?
Apr 03, 2025 am 12:03 AM
What are the magic methods of PHP? PHP's magic methods include: 1.\_\_construct, used to initialize objects; 2.\_\_destruct, used to clean up resources; 3.\_\_call, handle non-existent method calls; 4.\_\_get, implement dynamic attribute access; 5.\_\_set, implement dynamic attribute settings. These methods are automatically called in certain situations, improving code flexibility and efficiency.
