Difference between revisions of "PHP"
(→Security) |
(→code) |
||
| Line 50: | Line 50: | ||
=Security= | =Security= | ||
===code=== | ===code=== | ||
| − | * | + | * Dangerous functions |
| − | * | + | :*include() |
| − | * | + | :*eval() |
| + | :*mysql_query() | ||
| + | :*phpinfo() | ||
| + | :*pgsql_query() | ||
| + | :*system() | ||
| − | + | ||
| + | * Type Handling | ||
{{code | {{code | ||
| Line 63: | Line 68: | ||
}} | }} | ||
| + | |||
| + | * XSS | ||
| + | * SQL Injection | ||
| + | |||
| + | Preventing [[SQL injection]] in [[PHP]] applications is relatively simple, so long as you are thorough. String input, surrounded by single quotes can be sanitized with [http://php.net/manual/en/function.mysql-real-escape-string.php mysql_real_escape_string()], which will escape dangerous characters such as single quotes (as well as \, so that you cannot escape the escapes!). Sanitizing integer input can be done simply by casting the input to integer. | ||
===php.ini=== | ===php.ini=== | ||
Revision as of 23:24, 27 May 2012
PHP Hypertext Preprocessor Language is a server side interpreted language written in C that runs primarily on Linux environments. PHP scripts can be run directly or served as webpages.
|
This article needs immediate attention, and is in desperate need of content. |
Contents
Development Environment
PHP CLI
| Xochipilli says |
|---|
| Many Linux distributions package the PHP CLI separately |
- php -l check syntax
- php -v version
- php -e oneliner
Pear/Pecl
Your first application
Variables and data types
PHP is a dynamically-typed language, consisting of integers, arrays, associative arrays, strings, and classes.
Boolean Logic
Ternary Conditionals
Loops
User Input
User-Defined Functions
Defining functions in PHP is accomplished using the function keyword, followed by the function name and comma delimited arguments, surrounded by parenthesis:
function myFunction(arg1, arg2) { ... } |
If the function is encapsulated in an object, you may specify the visibility of the function, public, protected or private.
class MyClass { public function myFunction(arg1, arg2) { ... } ... } |
Unlike some programming languages, like Perl or Python, PHP member functions implicitly extract their parent into the $this variable.
Security
code
- Dangerous functions
- include()
- eval()
- mysql_query()
- phpinfo()
- pgsql_query()
- system()
- Type Handling
$clean_int = (int)$dangerous_int; |
- XSS
- SQL Injection
Preventing SQL injection in PHP applications is relatively simple, so long as you are thorough. String input, surrounded by single quotes can be sanitized with mysql_real_escape_string(), which will escape dangerous characters such as single quotes (as well as \, so that you cannot escape the escapes!). Sanitizing integer input can be done simply by casting the input to integer.
php.ini
See Also : PHP Patching
