接上篇中的第一部分，第一部分是php和mysql的基础部分，
这部分主要包括php的基本语法，包括语句，循环，操作符等等和c基本上一样的，然后是和c++比较类似的继承，错误处理，对象等方面的逻辑．
以及数据库的基本概念，包括直接操作数据库的语法，和使用php来查询数据库，或者编辑数据库，进程查询和插入操作都已经成功．
第十四章 网络应用程序和网络攻击
保护敏感数据
Attrack that involve accessing or modifying your data as it travels over the network are known as man-in-the-middle (MITM) attacks.
减少攻击
这章基本上讲述安全和攻击的章节，以后具体的时候再深入。
攻击网站 Open Web Application Security Project
第十五章 建立安全的网络应用
过滤用户的输入，多次检查输入值
<!DOCTYPE html>
<html>
<head>
<title>What be ye laddie?</title>
</head>
<body>
<h1>What be ye laddie?</h1>
<form action="submit_form.php" method="post">
<p>
<input type="radio" name="gender" id="gender_m" value="male"/>
<label for="gender_m">male</label><br/>
<input type="radio" name="gender" id="gender_f" value="female" />
<label for="gender_f">female</label><br/><?php
switch ($_POST['gender']) {
case 'male':
case 'female':
case 'other':
echo "<h1>Congratulations!<br/>
You are: ".$_POST['gender'].".</h1>";
break;
default:
echo "<h1><span style='color: red;'>WARNING:</span><br/>
Invalid input value specified.</h1>";
break;
}
?>把用户名和密码放在一个单独的文件中，使用include进行访问。
<?php
include ("private/dbconnect.php");
$conn = @new mysqli($db_server, $db_user_name, $db_password, $db_name, $db_port);
阅读php.ini文件。
防火墙
Keep the Operating System Up to Date
第十六章 使用php实现授权
Each computer connected to the Internet has a unique IP address.
More and more website provide content for free, but only to people willing to register an account and log in.
访问控制，创建登录用户
Rather than having PHP code like
if (($name == 'username') && ($password == 'password')) {
// OK passwords match
}
if (password_verify($password, $hash)) {
// OK passwords match
}
第十七章 服务器文件交互
修改/etc/php5/fpm/php.ini文件
修改file_uploads开关为On,表示可以上传文件
In the <form> tag, you must set the attribute enctype="multipart/form-data" to let the server know that a file is coming along with the regular information.
The data you need to handle in your PHP script is stored in the superglobal array $_FILES.
The entries in $_FILES will be stored with the name of the file <file> tag from your HTML form.
需要修改写路径的文件权限，一般ubutun只有other权限，所以要把权限变成757
chmod 755 file/directory -R
下面是一个文件上传示例
<html>
<head>
<title>Upload a File</title>
</head>
<body>
<h1>Upload a File</h1>
<form action="upload_server.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="MAX_FILE_SIZE" value="1000000" />
<label for="the_file">Upload a file:</label>
<input type="file" name="the_file" id="the_file" />
<input type="submit" value="Upload file" />
</form>
</body>
</html>会上传图片并且显示在本地
<html>
<head>
<title>Uploading...</title>
</head>
<body>
<h1>Uploading File...</h1>
<?php
$pictures = "http://47.93.38.195/";
if ($_FILES['the_file']['error'] > 0) {
echo "Problem: ";
switch ($_FILES['the_file']['error']) {
case 1:
echo "File exceeded upload_max_filesize.";
break;
case 2:
echo "File exceeded max_file_size.";
break;
case 3:
echo "File only partially uploaded.";
break;
case 4:
echo "No file uploaded.";
break;
case 6:
echo "Cannot upload file: No temp directory specified.";
break;
case 7:
echo "Upload failed: Cannot write to disk.";
break;
case 8:
echo "A PHP extension blocked the file upload.";
break;
}
exit;
}
// Does the file have the right MIME type?
if ($_FILES['the_file']['type'] != 'image/png') {
echo "Problem: file is not a PNG image.";
exit;
}
// put the file where we'd like it
$uploaded_file = '/data/images/'.$_FILES['the_file']['name'];
if (is_uploaded_file($_FILES['the_file']['tmp_name'])) {
if (!move_uploaded_file($_FILES['the_file']['tmp_name'], $uploaded_file)) {
echo "Problem: Could not move file to destination directory.";
exit;
}
} else {
echo "Problem: Possible file upload attack. Filename: ";
echo $_FILES['the_file']['name'];
exit;
}
echo 'File uploaded successfully.';
// show what was uploaded
echo "<p>You uploaded the following image:<br/>";
echo "<img src=\"".$pictures.$_FILES['the_file']['name']."\"/>";
?>
</body>
</html>
To ensure that you are not vulnerable, this script uses the is_uploaded_file() and move_uploaded_file() functions to make sure that the file you are processing has actually been uploaded and is not a local file such as /etc/passwd.
上传进度回显。
需要打开这两个开关
1545 ; Enable upload progress tracking in $_SESSION
1546 ; Default Value: On
1547 ; Development Value: On
1548 ; Production Value: On
1549 ; http://php.net/session.upload-progress.enabled
1550 session.upload_progress.enabled = On
1551
1552 ; Cleanup the progress information as soon as all POST data has been read
1553 ; (i.e. upload completed).
1554 ; Default Value: On
1555 ; Development Value: On
1556 ; Production Value: On
1557 ; http://php.net/session.upload-progress.cleanup
1558 session.upload_progress.cleanup = On
<html>
<head>
<title>Browse Directories</title>
</head>
<body>
<h1>Browsing</h1>
<?php
$current_dir = '../images/';
$dir = opendir($current_dir);
echo '<p>Upload directory is '.$current_dir.'</p>';
echo '<p>Directory Listing:</p><ul>';
while (false !== ($file = readdir($dir))) {
// strip out the two entries of . and ..
if ($file != "." && $file != "..") {
echo '<li>'.$file.'</li>';
}
}
echo '</ul>';
closedir($dir);
?>
</body>
</html><html>
<head>
<title>Browse Directories</title>
</head>
<body>
<h1>Browsing</h1>
<?php
$dir = dir('../images/');
echo '<p>Handle is '.$dir->handle.'</p>';
echo '<p>Upload directory is '.$dir->path.'</p>';
echo '<p>Directory Listing:</p><ul>';
while (false !== ($file = $dir->read())) {
if ($file != "." && $file != "..") {
echo '<li>'.$file.'</li>';
}
}
echo '</ul>';
$dir->close();
?>
</body>
</html>所以需要更加的努力，写代码，写代码，写代码。
执行代码，已经执行。
exec()
passthru()
system();
<?php
chdir('../images/');
// exec version
echo '<h1>Using exec()</h1>';
echo '<pre>';
exec('ls -la', $result);
foreach ($result as $line) {
echo $line.PHP_EOL;
}
echo '</pre>';
echo '<hr/>';
// passthru version
echo '<h1>Using passthru()</h1>';
echo '<pre>';
passthru('ls -la');
echo '</pre>';
echo '<hr/>';
// system version
echo '<h1>Using system()</h1>';
echo '<pre>';
$result = system('ls -la');
echo '</pre>';
echo '<hr/>';
// backticks version
echo '<h1>Using Backticks</h1>';
echo '<pre>';
// unix
$result = 'ls -al';
echo $result;
echo '</pre>';
?>第十八章 使用网络
检查可获取的网络
收发邮件
使用其它网站的数据
使用网络查询函数
使用ftp
第十九章 计算时间和日期
第二十章 国际化和本地化
第二十一章 生成图片
绘图
<?php
// set up image canvas
$height = 200;
$width = 200;
$im = imagecreatetruecolor($width, $height);
$white = imagecolorallocate($im, 255, 255, 255);
$blue = imagecolorallocate($im, 0, 0, 255);
// draw on image
imagefill($im, 0, 0, $blue);
imageline($im, 0, 0, $width, $height, $white);
imagestring($im, 4, 50, 150, 'Sales', $white);
// output image
header('Content-type: image/png');
imagepng($im);
// clean up
imagedestroy($im);
?>
绘制图形
蓝色正方形
第二十三章 JavaScript和php混合使用
jQuery和php混合
<html>
<head>
<title>Sample Form</title>
</head>
<body>
<form id="myForm">
<label for="first_name">First Name</label><br/>
<input name="name[first]" id="first_name" class="name" /><br/>
<label for="last_name">Last Name</label><br/>
<input name="name[last]" id="last_name" class="name"><br/>
<button type="submit">Submit Form</button>
</form>
<div id="webConsole">
<h3>Web Console</h3>
</div>
<script
src="http://code.jquery.com/jquery-3.2.1.js"
integrity="sha256-DZAnKJ/6XZ9si04Hgrsxu/8s717jcIzLy3oi35EouyE="
crossorigin="anonymous"></script>
<script>
var webConsole = function(msg) {
var console = $('#webConsole');
var newMessage = $('<p>').text(msg);
console.append(newMessage);
}
$(document).on('ready',function () {
$('#first_name').attr('placehoder', 'Johnny');
$('#last_name').attr('placeholder', 'Appleseed');
});
$('#myForm').on('submit',function (event) {
var first_name = $('#first_name').val();
var last_name = $('#last_name').val();
webConsole("The form was submitted");
alert("Hello, " + first_name + " " + last_name + "!");
});
$(".name").on('focusout', function (event) {
var nameField = $(event.target);
webConsole("Name field " + nameField.attr('id') + " was update to " + nameField.val());
});
</script>
</body>
</html>写完一个ajax和一个登录程序就收工。
563
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
