và tải điểm khác nhau của bạn. Chúng tôi sẽ xem xét chức năng này chặt chẽ hơn trong thời gian ngắn: Chức năng tiếp theo bạn định nghĩa là một chức năng tiện dụng tạo ra một điểm đánh dấu cho bản đồ Google của bạn. Điều này không thực sự đánh dấu bản đồ, bạn tạo ra các điểm sử dụng chức năng này sau đó thêm nó sau này. | CHAPTER 12 SECURITY 193 Thankfully PHP will automatically handle the deletion of old sessions using its session garbage collection settings but you should still strongly consider using these other recommendations. Cross-Site Request Forgery Cross-site request forgery CSRF is a type of attack in which a script in your web application is executed unknowingly by an authorized user. As shown in the previous section on XSS a malicious user and an unprotected site can result in an innocent party executing dangerous JavaScript. In the XSS example the malicious JavaScript resulted in session IDs being stolen potentially allowing the attacker to hijack user sessions later on. A CSRF attack differs in that it makes the innocent user perform some action on the web site that they are unaware of and that requires their privilege level to perform. In a sense you could say that a CSRF attack is the opposite of an XSS attack an XSS attack results in the trust a user has for a web site while a CSRF attack results in the trust a web site has in a user. Let s look at an extreme example. Suppose the Insecure Bank Co. has a web site that allows you to manage your funds including transferring money to people anywhere in the world. Additionally they also have a web forum on their site where customers can talk to each other for what purpose I m not sure . Bob has decided he wants to steal other people s funds which he figures he can do using a CSRF attack. Bob posts a message to the forum containing some evil JavaScript code. The address of the forum message is http forum. php message 1234. Now Julie logs into her online banking account and notices that a new message has been posted to the forum. When she reads the message the JavaScript hidden in the message causes Julie to unknowingly open http transfer. php amount 10000 to 12345678. This script then transfers 10 000 to the bank account 12345678 which coincidentally belongs to Bob The attack was
