Đang chuẩn bị liên kết để tải về tài liệu:
Professional PHP Programming phần 7

View_transactions.php kịch bản hiển thị các giao dịch của người dùng như thể hiện trong một ảnh chụp màn hình trước đó, ví dụ, khi nhấp chuột quản trị viên liên kết của một người sử dụng, chẳng hạn như hrawat, để xem các giao dịch của người sử dụng Harish Rawat. | if part 1 255 part 2 255 part 3 255 part l 255 return TRUE Valid IP _ _ return FALSE Invalid IP Conclusion Security is a state of mind. When you develop scripts you should be thinking about what you can do to make the scripts safer. A secure web server running on a secure server gets you a long way but you still need to be security conscious yourself. 21 Magic With Quotes Magic quotes can be used to automatically encode external data so that it can be used suavely in SQL queries. However they do not present the best solution to the problem where they are applied. This chapter explains the basics of applying magic quotes why they are necessary and what alternative methods exist. Defining the Problem PHP scripts usually receive data from web clients. This data cannot be trusted because malicious clients may send malformed data. It is therefore necessary to validate input data before processing it. Magic quotes help to ensure that input data is in a correct format before using it in SQL queries. SQL defines certain characters that have a special meaning. A malicious attacker can use these special characters to insert arbitrary SQL into your queries which can lead to security holes. How can you protect your scripts from this potential security threat The Conversion Process Special characters include backslash double quote and NUL . These have a special meaning and could therefore cause misinterpretation by the SQL engine. To avoid this each instance of a special character is prefixed by an escape character. The inbuilt PHP function addslashes is called to prepend backslash characters to a specific set of characters in order to render them escaped. The following table lists the SQL special characters and to which character sequences they are encoded. Note that we do not use C-like encoding so is not one escaped backslash but two backslashes. Special Changed character To NULL 0 The table above is relevant for most situations however PHP supports a special mode where an .